Self-hosted file transfer with a passphrase that works anywhere. Files go peer-to-peer between any two devices. The relay never sees your bytes.

Try it: airpipe.sanyamgarg.com

1. Sender picks a file. Gets a passphrase like RIVER FALCON MARBLE 42.
2. Receiver types it at the homepage, runs airpipe download <PHRASE>, or scans the QR.
3. Both pair through the relay, then the file streams directly between them over WebRTC.
4. If the receiver isn't online yet, the sender can pick "mailbox" mode instead. The relay holds the encrypted file for 10 minutes.

Same passphrase works for both modes. Receiver doesn't need to know which one the sender chose.

docker run -p 8080:8080 ghcr.io/sanyam-g/airpipe-relay

That's it. One Go binary, ~15 MB image. Bundles the landing page, browser sender/receiver, and the install script.

Or with the bundled docker-compose.yml (includes an opt-in Watchtower sidecar that auto-pulls new images):

git clone https://github.com/Sanyam-G/Airpipe
cd Airpipe
docker compose up -d

Point the CLI at your relay (per-call):

airpipe --relay https://your-server.example send file.txt

Or set it permanently:

export AIRPIPE_RELAY=https://your-server.example
airpipe send file.txt

Env vars if you want to tune things:

Install:

curl -sSL https://airpipe.sanyamgarg.com/install.sh | sh

Or via Go:

go install github.com/Sanyam-G/Airpipe/cmd/airpipe@latest

Self-update later: airpipe update. Linux + macOS + Windows, amd64 + arm64.

On Windows, grab airpipe-windows-amd64.exe from the latest release and put it on your PATH.

airpipe send report.pdf

You get a prompt: direct (P2P) or mailbox (relay holds it 10 min). Pick one. The CLI shows a passphrase, a QR, and a link.

airpipe download RIVER FALCON MARBLE 42

Multiple files or a folder get auto-zipped:

airpipe send file1.txt photos/

airpipe receive ./downloads

Prints a QR. Phone scans it, drops a file, the file lands in ./downloads. Direct WebRTC, fallback to relay if NAT punching fails.

Open airpipe.sanyamgarg.com/live. Get a passphrase + QR. Receiver types the passphrase at the homepage in their browser. Both pair, sender drops a file. No CLI, no app, no account.

NaCl secretbox (Poly1305 + XSalsa20, 256-bit key) on top of DTLS for the live path. The key never leaves the side that generated it. The relay only sees a 16-char room token and ciphertext.

The passphrase derives both the relay token and the encryption key via SHA-256 with domain separation. Same algorithm on CLI and browser.

Go relay (gorilla/websocket, pion/webrtc), embedded HTML/CSS/JS frontend (tweetnacl.js for browser crypto), Docker, Cloudflare Tunnel optional. Single static binary.

MIT