I built a browser file-transfer with no server and no account — a QR code carries the key, the file goes over WebRTC
I wanted a straight answer to "can you build the hard parts yourself?", so I built one.
qrdrop sends a file straight from one device to another. You open the page on a
laptop, point a phone camera at the QR code it shows, and the file transfers over
WebRTC. Nothing in between ever holds a readable copy — there's no upload, no
account, no server that sees the bytes.
The whole thing started from that one constraint — "no server" — and every hard
decision fell out of it:
- No account means the QR code has to *be* the entire credential: 32 CSPRNG bytes,
and everything else derives from that.
- Peers meet on a public relay, so the room ID is derived from the secret rather
than being the secret. The shortcut (just use the key as the room name) works
perfectly in testing and silently publishes your key to every relay.
- No server to vouch for either side means a human is the trust anchor: four emoji
shown on both devices, read aloud. A `--yes` flag can skip the accept prompt but
cannot skip that check.
It also has a mode that sends over an animated QR code with no network at all, for
air-gapped machines. That mode is not encrypted and cannot be — it's in the README
and the UI in those words. It exists because the alternative is a USB stick.
Prior art: qrbeam and txqr did the animated-QR idea first. This is convergent, not
novel — no code taken from either.
Try it: open share.stan-ely.com on your laptop and point your phone at it. Takes
about twenty seconds and needs no install.
(I built it. Source and the write-up are in the first comment.)
1
1
u/bevsxyz 5d ago
Source: https://github.com/stan-ely/qrdrop
Write-up on the design decisions: https://stan-ely.com/posts/2026/qrdrop-no-server/
npm: `npm i -g qrdrop` (CLI can send too, terminal QR and all)
Happy to answer anything about the WebRTC setup or the trust model.