Floe
Secure, encrypted P2P file transfer.No accounts, no file storage, and no registration required.
How it works
Your files never make a stop.
Two devices open an encrypted WebRTC channel and stream bytes to each other. A small server introduces them, then steps out of the way.
Drop your files
Click Create secure link for a share link, with a QR code one click away. The link's secret part, after the #, never appears in page requests, server logs, or analytics.
Share either one
Your peer opens the link in a modern browser, scans the QR, or pastes the link into the desktop app or the CLI. No account on either side.
Watch it stream
Bytes move device to device over the encrypted channel. Close the tab and the transfer stops. No file is ever left on a server.
Privacy
The server can't read what it never receives.
Floe's signaling server exists to introduce two devices. This is the complete list of what it handles.
The signaling server handles
- The messages two devices trade to connect (WebRTC offers, answers, and ICE candidates), which carry their network addresses
- The room id that pairs two devices, which is the secret part of a share link, held in memory while the room is open and written to no log
- A short room code when the sender uses the CLI or desktop app, kept until the receiver joins or the room closes, and about 10 minutes at most
- TURN relay credentials, valid for 24 hours and not tied to you or an account
- One anonymous running total of bytes for the public counter
- Your IP address, in memory while your device is connected and, to rate-limit abuse, for up to about two minutes after its last request
- The web address each connection says it comes from (its Origin), checked against an allow-list and logged only for the first one refused on each connection path
- While a room is open, a one-way code made from each device's network address (a keyed hash), never the address itself, so that a third network cannot take a seat
- While a request link is open, a hash of its secret token, never the token, and its times: made, joined, left, and due to end
- For a day after a request link closes or ends, its room id and a mark saying it was used or ended
- The times each network made a request link, kept for 24 hours under a keyed hash of its address
- How many request links each network has open, under the same keyed hash
It never sees
- Your files, file names, or folder structure
- The
#roompart of your share link in any page request, referrer, or analytics event. It travels in none of them - The link id in a request link's address (the part before the #), which only the web host sees
- Any transfer traffic. Once the peers connect, the data channel bypasses it entirely
- Relayed traffic in the clear. Relay packets stay encrypted end to end
The floe.one website also runs cookieless analytics (Umami) and error monitoring (Sentry). Floe Desktop and the CLI have neither. What they do send is in the privacy policy.
Command line
The same transfer, without the browser.
floe is one file with nothing else to install, and it uses the same server as the web app. Browser to terminal works in every direction, and a folder arrives with its structure intact in the CLI and Floe Desktop, or inside "Download ZIP" in a browser.
> winget install jannskiee.floefloe send <path>Share files or entire foldersfloe send <path> --to <link>Send through a Floe Desktop request linkfloe receive <code>A short code is all the other side needsfloe updateUpdates itself in place, unless a package manager installed it
Also available via Scoop, a PowerShell one-liner, and go install, which gives a dev build that cannot update itself. On a Mac without Homebrew, the Linux command works too. Installation guide
Example terminal session: floe send shares three files totaling 10.1 MB, prints the short code olive-tiger-castle and a link, connects directly to the peer, and completes the transfer in 8 seconds at an average of 1.3 MB per second. Its summary includes the line Verified, SHA-256 matched.
Desktop
Transfers that outlive the tab.
Floe Desktop is the same app, running natively on Windows. Drop a folder to send it without zipping, paste a screenshot straight from the clipboard, get a notification when a transfer lands. Same rooms, same end-to-end encryption as browser and CLI peers.
- Paste to sendCtrl+V a screenshot or files copied in Explorer
- FoldersSent as folders, no zipping
- HistoryWhat you sent and received, stored locally
- Request linkSomeone sends files to your PC from their browser
v1.0.0 · Windows
Demo of the Floe desktop app: three files are staged, then a share panel opens a live room with the code quiet-fetch-sled and a share link, waiting for the receiver.
Capabilities
No asterisks.
The fine print, printed large. Every claim below holds for the current release.
No size limit from Floe
Floe sets no size limit on a direct connection; a browser that receives is limited by what that browser can hold. Relayed sessions cap at 2 GB, and the badge shows which one you are on.
Browser to terminal
The web app, Floe Desktop, and the CLI share one protocol. Send from a server, receive on a phone, any direction.
Folders stay folders
The CLI and Floe Desktop send a folder whole and rebuild its structure when they receive one. A browser keeps the structure when you use "Download ZIP".
Honest progress
Progress for each file with live speed and time left, in the browser and in the terminal.
Checked on arrival
Each file is checked against its announced size and, when the sender sends one, a fingerprint of its contents (SHA-256). A mismatched file is discarded. CLI and Floe Desktop receivers confirm delivery.
Open source, self-hostable
MIT licensed, every line on GitHub. Run your own signaling server and relay with Docker; the docs cover production setup.
FAQ
Questions, answered plainly.
It's simple! Here's how it works:
For Senders:
- Drag and drop your files (or click to select them)
- Click "Create secure link", then copy the link that appears
- Send that link to your friend (one link serves one receiver at a time)
- Keep your browser tab open until the transfer finishes
For Receivers:
- Open the link your friend sent you
- Wait for the connection (the status badge shows "Direct" or "Relay")
- The files arrive on their own, straight from your friend's device
- Save each file with its download button, or use "Download All" or "Download ZIP" when there is more than one
That's it! No accounts needed, no waiting for uploads.
Yes. The floe CLI installs as a single binary and talks to the same infrastructure as the web app, so browser-to-terminal transfers work in every direction. Run floe send with a file or folder and share what it prints: the link opens in a browser, and the link or the code works with floe receive and in Floe Desktop.
Yes. Floe Desktop is a small native app for Windows that speaks the same protocol as the web app and the CLI, so any two can transfer to each other. It sends folders without zipping, pastes screenshots and copied files straight from the clipboard, and shows a notification when a transfer finishes. Install it from the Microsoft Store via the download page.
Yes, with a request link. In Floe Desktop, open Receive, choose Request link, and make a link to send to the other person. They open it in current Chrome or Edge on a computer and pick what to send, or run floe send --to with the link in the CLI. Floe Desktop shows you how many files are coming and how large they are, and nothing is saved until you accept, unless you turned on Auto-accept for that link. A link works once, for one batch of files, and only while Floe Desktop is open on your PC. The details are in Request links.
Your files are never stored on any server. In direct connections, data flows straight between devices.
In relay connections, the encrypted data passes through a relay server on its way (on floe.one, Cloudflare's network), which only forwards it and cannot decrypt it. The relay's operator can see both IP addresses and when and how much data passes, never the contents.
What you receive stays on your own device: a browser holds it, ready to save, until you close the tab, and Floe Desktop and the CLI write it straight to a folder on your disk. Floe Desktop also keeps a history of your last 50 transfers on your PC (file names, sizes, and times, never the files), which you can clear.
As much as that browser can hold, because the web app keeps what it receives inside the browser until the tab closes. Chrome and Edge in a normal window move what does not fit in memory into temporary files on disk, so the ceiling there is set by your disk. Firefox, Safari, private windows, and every browser on iPhone and iPad keep it all in memory and fill up much sooner. When a browser runs out, the transfer stops, and Floe says so if the tab is still running. For multi-gigabyte files, receive with Floe Desktop or the CLI, which write straight to disk. The limits browser by browser are in Known limitations.
Yes. Only the two devices can read your files: every transfer is encrypted with DTLS, built into WebRTC, with keys that exist only on those two devices. Whether your connection is direct or relayed, everything in between, the relay included, handles only encrypted packets. Two limits are worth knowing. The codes the two devices use to recognize each other (their certificate fingerprints) pass through Floe's signaling server, so you are trusting that server not to swap them, and no Floe app shows a verification code to check it today. And the link or code is all that protects a transfer: whoever uses it first, while the sender is waiting, receives the files, so send it over a channel you trust. The full list of what Floe does not protect against is in Known limitations.
Floe checks every file for you. Each one must match the size the sender announced, and when the sender provides a SHA-256 of the file (a fingerprint of its contents), the receiver also compares that with what actually arrived. A floe CLI older than 1.11.0 or a Floe Desktop older than 0.3.0 provides none, and a browser sending a very large file can finish sending it before its SHA-256 is ready, and then ends that file without one. A file that does not match is discarded instead of saved. When every file matched, the CLI shows "SHA-256 matched", and the browser and Floe Desktop show a green check mark. A gray check mark, or none, means at least one file was checked by size only, or the transfer stopped partway. The sender sees the mark only when the receiver reports back that every file matched. A match means the file arrived intact, not that it is safe to open: Floe does not scan files for malware. What the check proves is in File checks.