Questions
The basics
What is peer.io?
A way to send a file straight from your browser to someone else’s. You choose a file, read them a short code or send them a link, and the file travels directly between your two devices. Nothing is uploaded to a server along the way.
Does it cost anything?
No, and there are no accounts or adverts. If you find it useful, you can buy a peer a beer.
How big can a file be?
There’s no set limit. Files are read from and saved to disk in small pieces, so they don’t need to fit in memory. The practical limits are your connection speed, how long you can both keep the page open, and the space on the recipient’s device. For very large files, Chrome or Edge on a computer is the most reliable.
Which browsers does it work in?
Recent versions of Chrome, Edge, Firefox and Safari, on computers and phones.
Privacy and security
Can you see my files?
No. Files, file names and messages never reach our server. It only introduces the two browsers to each other and then steps out of the way.
Is the transfer encrypted?
Yes, always, end to end from one browser to the other. That includes transfers that have to be relayed: the relay passes the data along without being able to read it.
How do I know nobody is listening in?
The two browsers check this for you automatically, whether the code is typed in or the link is opened. Only the number at the start of the code is sent to our server. The two words stay in the two browsers, and each uses them to confirm that the other is at the far end of the connection, with nobody in between. If the check fails, the transfer stops before anything is sent.
What if someone guesses the code?
A wrong guess gets nothing, and the sender’s page shows that someone tried. After three failed attempts the transfer stops and the sender can start a new one with a fresh code. With 65,536 possible pairs of words, the chance of a stranger guessing right within those three tries is about 1 in 22,000.
Can the other person see my IP address?
Usually, yes. Because your browsers connect directly, each can see the other’s IP address. If that matters to you, only send files to people you know. The privacy page has the details.
Do you keep anything?
Only standard web server logs, for up to 7 days, to keep the service secure, and anonymous running totals such as how many transfers there have been and the largest so far. Transfer codes and connection details are held in memory and gone within 10 minutes of you both leaving.
Sending and receiving
Why do I need to keep the page open?
Because the file comes from your device, not from us. If you close the page, there’s nothing left to send. Both of you need the page open until the transfer finishes.
What happens if the connection drops?
As long as both pages stay open, peer.io reconnects by itself and carries on from where it stopped, so nothing is sent twice. If the recipient closes or reloads their page, they can open the link again and start receiving from the beginning. If the sender closes theirs, the transfer ends and they’ll need to start a new one.
How long does a code last?
For as long as the sender’s page is open, plus 10 minutes if they lose their connection. Each code works for one recipient at a time: while someone is connected, nobody else can use it. Three attempts with the wrong words end the transfer.
Is it safe to send the link by WhatsApp or email?
Yes. The link only works while the sender’s page is open, and only for one person at a time. Whoever opens it can receive the file, though, so send it just to the person it’s for rather than posting it in a group.
Does it work on a phone?
Yes, but phones pause pages you aren’t looking at. Keep peer.io on screen until the transfer finishes. It asks your phone to keep the screen on while it’s working.
It says the transfer was relayed. Why?
Some networks, often at work, university or on mobile data, don’t allow direct connections. When that happens, the encrypted transfer goes through a relay instead. It’s just as private, but can be slower.
Does it work with a VPN?
Often, but not always. To protect your real address, many VPNs and privacy extensions stop the browser making the direct connections peer.io uses. If that happens, peer.io tells you your browser isn’t allowed to connect. Pause the VPN or extension for the transfer, or use a different browser. Your file is still encrypted end to end without it.
It won’t connect.
Check that you’re both on the same code and both pages are open. If it says the code didn’t match, check the two words with the sender: a single wrong letter is enough. If it still won’t connect, one of you is probably on a network that blocks this kind of connection. Try again on a different network, such as home Wi-Fi instead of mobile data.
Receipts
What does the receipt show?
Each browser calculates a fingerprint of the file (its SHA-256 hash) as it is sent and received. If the two match, the file arrived exactly as it was sent, down to the last byte. The receipt records that fingerprint, the file’s name and size, and when the transfer started and finished.
What does “signed and sealed” mean?
At the end of a transfer, each browser signs the receipt’s details with a key it made just for this transfer, so you can tell later if anything in them has been changed. The two browsers swap these keys inside the connection check, so each knows the other’s key belongs to whoever had the code.
peer.io then adds a seal: its own signature and the time from its own clock. The seal shows that the receipt existed, exactly as it is now, at that time. To make the seal, the sender’s browser sends us a single scrambled value worked out from the receipt. We can’t turn it back into the receipt, the file or anything about you, and we don’t keep it.
How do I check a receipt?
Go to peer.io/verify and drop in the saved receipt, and the file if you have it. Your browser checks both signatures, the seal and the file’s fingerprint, and tells you separately which passed. Nothing is uploaded. Anyone you give the receipt to can check it the same way.
What doesn’t it show?
Who either person was. The signing keys are made fresh for each transfer and aren’t linked to anyone, and anyone with the code or link can receive a transfer. The start and finish times come from the recipient’s device; only the seal’s time comes from us. The seal shows that a receipt existed at a given time, not that what it says is true. We don’t look at, store or keep any record of receipts.
What is the check phrase?
Four words made from the file’s fingerprint. Read them to each other: if you both see the same words, you both have the same file. It’s an easy way to check without comparing 64 characters.
How can I check a copy of the file later?
Calculate its fingerprint and compare it with the one on the receipt. On a Mac or Linux, open Terminal and run shasum -a 256 followed by the file name. On Windows, run certutil -hashfile, the file name, then SHA256.
Something else
How do I report misuse?
Email [email protected]. See the terms for what isn’t allowed.