Private browser-to-browser transfer
Transfer files without storing them in the cloud
LanCopy is not an upload-now, download-later service. Both devices are connected at the same time and exchange selected files in real time. A small server helps the browsers find and connect to each other, but it receives no decryptable file or chat content and is not used as cloud file storage.
Open LanCopyA direct transfer instead of an upload link
With a conventional cloud service, the sender uploads a complete copy. The receiver retrieves it later from a link, and the provider has to store it at least temporarily. LanCopy uses a different model: sender and receiver keep the page open together while the file is transferred across the active connection.
This also means that closing the sender’s tab or losing the connection leaves no completed copy waiting on a LanCopy server. The transfer must be started again if needed. LanCopy provides real-time transfer rather than a permanent download link.
Peer-to-peer file transfer with WebRTC
WebRTC is the browser technology LanCopy uses to create a data channel between two devices. A signaling service briefly exchanges session descriptions and connection candidates. The browser also contacts a configured STUN service to discover network addresses that may work for a direct connection.
On a reachable local network, WebRTC will normally prefer a local path. A direct internet connection with a private code may also be possible. The current shared-hosting edition does not operate a TURN relay, however, so connection setup can fail on restrictive corporate networks, symmetric NAT or certain mobile networks.
What the end-to-end encryption protects
WebRTC already encrypts its transport. LanCopy adds an independent application layer. Both browsers create fresh key material for every connection and derive separate AES-256-GCM keys for control messages and file chunks.
Protected data includes chat text, file content, filename, size, media type, group information and acceptance or rejection. Manipulated or replayed encrypted messages are rejected. Ephemeral session keys remain in browser memory and are not stored as account keys on the server.
What the signaling server can briefly know
Discovery, abuse controls and WebRTC setup require limited operational information: the requesting network address, chosen display name, a random browser-session identifier, temporary network or room grouping, and WebRTC signaling data. ICE candidates can contain addresses or mDNS names supplied by the browser.
The LanCopy application stores no files, filenames or chat histories. Inactive device entries disappear after roughly 60 seconds; delivered signals are removed on the following poll and undelivered signals after no more than five minutes. Outside the application, the hosting provider may retain ordinary access, security or backup logs under its own rules.
Encryption and identity verification are different
A secure invitation link carries a random secret after the # character. Browsers do not include this URL fragment in normal HTTP requests to the web server. LanCopy binds it into the key exchange so both browsers can prove possession of the same invitation secret.
With an automatically discovered LAN connection, contents remain encrypted but identity is initially unverified without a shared invitation link. For sensitive files, compare the 16-character safety code on both devices. Compromised endpoints, malicious browser extensions or JavaScript modified before delivery remain outside this protection.
FAQ
Frequently asked questions
Can the LanCopy server see the filename?
Not inside the data channel. Filename, size, media type and file content are protected by the additional application encryption. The server only processes short-lived information needed for device matching and WebRTC setup.
Does “no cloud” mean “no server”?
No. LanCopy needs a website and signaling service, but it does not store the files being transferred there. The phrase describes the absence of cloud file storage, not the absence of all infrastructure.
Is HTTPS already end-to-end encryption?
HTTPS protects the browser-to-web-server connection. LanCopy’s additional E2E layer protects payloads between the participating browser sessions, preventing the signaling server from decrypting them.
Does LanCopy store my IP address?
For grouping and limits, the PHP application stores installation-bound HMAC values rather than the raw IP address in its database. The network address and time may still appear in ordinary logs maintained by the hosting provider.
Can a network operator still observe anything?
It can observe connection destinations, timing and encrypted packet sizes, but not the file or chat contents protected by LanCopy. A STUN or possible relay service also sees the network address required for its role.
Ready for a direct transfer?
Open LanCopy on the participating devices, give each one a clear name, then select the receiving device.