How Transferinho keeps your files private
Transferinho was designed around one rule: your files and your keys must never exist anywhere except on the two devices taking part. Here is how that works, in plain English.
Send files now — it’s freeThe short version
- Each room has a random 128-bit secret that lives only in the link.
- The server just introduces the two browsers, and can’t read what they tell each other.
- Files travel directly between the browsers over an encrypted WebRTC connection.
- Nothing is stored: no files, no keys, no IP addresses.
1. The key lives in the link
When you start a room, your browser generates a random secret and puts it after the “#” in the address. Browsers never send that part of a URL to any server — it stays on your device and on the device you share the link with.
From that secret, each browser derives two values: a room ID that the server uses to pair you up, and an AES-256-GCM key that only the two browsers have.
2. The server only makes introductions
To open a direct connection, two browsers first need to exchange a little set-up information. Transferinho’s server passes these messages along, but every one of them is sealed with the room key, so the server sees only encrypted data it can’t read or alter. A room holds at most two devices and disappears once both have left.
3. Files go directly, encrypted by WebRTC
The browsers then connect to each other with WebRTC, the same standard used for video calls. All WebRTC data is encrypted with DTLS. The fingerprints that protect that encryption are exchanged inside the sealed set-up messages, so not even the server could put itself in the middle.
Files are split into small chunks and streamed across with flow control, so memory use stays low and the receiver writes straight to disk.
4. Nothing is stored
There is no file storage, no database of rooms and no account system. The only thing Transferinho records is anonymous usage counts — browser, operating system and country — without IP addresses, file names or room secrets.
What you should know
- Anyone with the link can join an empty slot in the room, so share it only with the person you are sending to.
- Like torrents and video calls, a direct connection means the two devices learn each other’s IP address.
- Every incoming file has to be accepted, file names are sanitised, and nothing opens automatically.
- The site loads no third-party scripts, fonts or trackers, and enforces a strict Content Security Policy.