qrdrop: what 'no server' forces you to build
"No server" sounds like a feature you'd put in a bullet list. It isn't one. It's a constraint, and constraints don't hand you good decisions — they just remove the bad ones that would otherwise have been easiest. qrdrop is a file-transfer tool ( npm i -g qrdrop , or just try it at share.stan-ely.com ) built around exactly one rule: nothing in between the two devices ever holds a readable copy of…
qrdrop is a file-transfer tool that enforces the rule of never storing a readable copy of the file on any server between the two devices. It requires scanning a QR code to authenticate the devices, which contains a 32-byte secret used to derive all necessary information such as room ID, password, session keys, and spoken words. The QR code must be the only credential, eliminating the need for an account or server to authenticate devices.
The room ID is derived from the secret using HKDF, not the secret itself, preventing relays from obtaining decryption keys. WebRTC signaling uses a password derived from the secret, but humans must confirm they are connecting to the correct devices by matching four displayed emojis. Data is encrypted twice: first with DTLS and WebRTC, then with an ephemeral ECDH key to seal the file bytes.
This two-layer encryption ensures that even if a TURN relay operator sees packet contents, they cannot access the actual file data.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
