Security

Last updated October 26, 2026. This page explains how Nearsend protects a transfer, what the server can and cannot see, and what is not covered. It describes how the service is built today. It is not a certification, and Nearsend has not had an independent security audit yet.

How your files travel

Files, folders, text and clipboard items go straight from one browser to the other over a WebRTC data channel, which is encrypted with DTLS. The Nearsend server is not on that path and never receives file contents. It only passes along the short setup messages two browsers need to find each other: WebRTC offers, answers and network candidates.

Before anything is sent, the receiving device has to accept the transfer. When you send to several devices at once, each one is asked separately.

Pairing

• The 6-digit PIN, the QR code token and the voice phrase are created with a cryptographically secure random generator.
• A pairing code expires after 3 minutes, and creating a new one replaces the old one.
• Every pairing request has to be approved on the device that created the code, so knowing a code is not enough to connect.
• Wrong codes are limited to 8 attempts per minute from one network address.
• Devices only appear in the nearby list for other devices on the same network. Anything else needs a code, QR code or phrase.
• Local-only mode in Settings keeps connections on the local network and skips external STUN servers.

What the server sees and keeps

While a device is connected, the server holds its device name, emoji, a value derived from its network address (used to decide who is nearby) and its connection status. That data is removed when the device disconnects, and pairing codes are removed when they expire.

The server code does not write file names, file contents or pairing codes to its logs. Like any web host, the hosting platform may keep standard request logs, such as IP addresses.

Finding a route between devices

To find a path between two devices, browsers use public STUN servers (Google and Twilio). A STUN server sees the IP address of the device that asks, as with any use of STUN.

Nearsend does not route transfers through a relay (TURN) server. If a network blocks a direct connection, the transfer does not start and Nearsend tells you, instead of sending the data through a third party.

Protections on the website

• The site is served over HTTPS only, with HTTP Strict Transport Security set for one year.
• A Content Security Policy limits where scripts, styles, images and connections can come from. It still allows inline scripts, so it is one layer of defense and not a guarantee.
• X-Content-Type-Options, X-Frame-Options (same origin only) and a strict-origin-when-cross-origin Referrer-Policy are set on every response.
• The signaling connection only accepts browsers coming from nearsend.app, and messages larger than 128 KB are refused.

Private rooms

A private room connects up to 5 devices to each other. By default the host approves each person who asks to join, and the host can remove someone or close the room. The invite link and QR code contain a random token. If the host turns approval off, anyone who has the link or code can join, so share it only with people you trust.

Analytics

Nothing from Google Analytics or Microsoft Clarity loads until you press Accept on the consent banner. If you decline, nothing is loaded and no analytics cookies are set. The events recorded are general ones such as page views, pairing started, completed or failed, and transfer started, completed or failed with counts and types. File names and contents are never sent, and text on the send and receive screens is masked in recordings. You can change your choice in Settings.

On your own devices

• A received file is held in the browser until you save it, so very large transfers need enough free memory. Nearsend warns you before you accept a very large one.
• Transfer history is kept in your browser only and can be cleared in Settings.
• A page reload ends a live connection. To set it up again, the tab remembers who it was paired with (names only) until the tab is closed.

What this does not cover

• Nearsend has not been independently audited or penetration tested.
• Pairing shows that a device was approved, not who is holding it. Check the device name before you accept a request or a transfer.
• Transfers are encrypted while they travel. Files on the devices themselves are as safe as those devices are.
• Malware or a malicious browser extension on a device can read whatever that browser handles.

Report a vulnerability

If you find a security problem, email security@nearsend.app with the subject "Security" and the steps to reproduce it. We aim to acknowledge reports within 5 working days.

Please do not access other people’s data, disrupt the service, or publish details before we have had a reasonable time to fix the issue. The same contact details are in our security.txt file at /.well-known/security.txt.

See also the Privacy Policy and How It Works.

Guides

Phone to PC Send Folders Large Files Without an App LocalSend Alternative P2P Transfer Without Shared Wi-Fi Private Sharing