WebRTC based P2P file transfers in your browser

A fork of FilePizza — with thanks to Alex Kern and Neeraj Baid for the original work.

Using WebRTC, CheezyPizza eliminates the initial upload step required by other web-based file sharing services. Because data is never stored in an intermediary server, the transfer is fast, private, and secure.

• Resumable downloads. Transfers interrupted by network drops, browser crashes, or manual pauses can be resumed from where they left off. Progress is persisted to OPFS or IndexedDB so no data is re-downloaded unnecessarily.
• SHA-256 file integrity verification. Every file is hashed by the uploader after transfer and verified by the downloader. A mismatch flags the file as corrupt before it is ever saved to disk.
• Large file support. Files are written incrementally to the Origin Private File System (OPFS) or IndexedDB as chunks arrive, with automatic fallback between the two, allowing transfers well beyond what fits in memory.
• Better error handling. Per-file errors are tracked independently. A failed or corrupt file does not block other files in a multi-file transfer. Integrity failures clean up partial data automatically.
• Application-level flow control. With high/low watermarks on the WebRTC data channel prevents buffer bloat and keeps transfers smooth at high speeds across varying network conditions.
• Automatic reconnect on network change. When a device switches networks (e.g. mobile data -> Wi-Fi) or a connection drops, CheezyPizza detects the reconnection and resumes the download automatically from the last saved offset.
• Multi-file transfers with per-file progress. Upload multiple files at once. The downloader receives them as a zip archive.
• Password protection. Transfers can be protected with a password, verified before any file is transferred.

NOTE: TURN support has been added. As I am an individual maintainer (and just a student) and would not be able to afford it without donations (will add it in future). There may be limitations.

Every browser implements OPFS and persistant storage differently. Thus, some browser's may limit the total storage quota per tab or origin. Browser quota limitations affect the pause-resume feature because of the file-size restriction. You can read more on this here: MDN Storage Quota Docs

All the features of the website should work on Chrome and Chromium based brwosers (except Brave).

	Chrome	Firefox	Edge	Safari	Opera	Vivaldi	Brave
Desktop
File transfer (WebRTC)	✅	✅	✅	*	✅	✅	✅
OPFS storage (large files)	✅	✅	✅	*	✅	✅	⚠️ limited
Resumable downloads	✅	✅	✅	*	✅	✅	⚠️ limited
SHA-256 integrity check	✅	✅	✅	✅	✅	✅	✅
Password protection	✅	✅	✅	✅	✅	✅	✅
Multi-file zip download	✅	✅	✅	✅	✅	✅	✅
Mobile
File transfer (WebRTC)	✅	✅	✅	*	✅	✅	✅
OPFS storage (large files)	✅	⚠️ limited	✅	*	✅	✅	⚠️ limited
Resumable downloads	✅	⚠️ IDB fallback	✅	*	✅	✅	⚠️ limited
SHA-256 integrity check	✅	✅	✅	✅	✅	✅	✅
Streaming save (no memory cap)	✅	⚠️ partial	✅	*	✅	✅	✅
Password protection	✅	✅	✅	✅	✅	✅	✅
Auto-reconnect on network switch	✅	✅	✅	✅	✅	✅	✅

⚠️ = supported with limitations. OPFS write access varies by browser version and storage quota policies.
* = Not yet tested

$ git clone https://github.com/hariharjeevan/cheezypizza.git
$ pnpm install
$ pnpm dev
$ pnpm build
$ pnpm start

$ pnpm docker:build
$ pnpm docker:up    # Go to http://localhost:3000/
$ pnpm docker:down

• Next.js
• React
• TypeScript
• Tailwind CSS
• PeerJS (WebRTC)
• Zod
• hash-wasm
• fflate (client-side zip)
• Vitest + Playwright (testing)
• Redis (optional, for channel metadata)

The server can be customized with the following environment variables:

• REDIS_URL – Connection string for a Redis instance used to store channel metadata. If not set, CheezyPizza falls back to in-memory storage.
• COTURN_ENABLED – When set to true, enables TURN support for connecting peers behind NAT.
• TURN_HOST – Hostname or IP address of the TURN server. Defaults to 127.0.0.1.
• TURN_REALM – Realm used when generating TURN credentials. Defaults to file.pizza.
• STUN_SERVER – STUN server URL to use when COTURN_ENABLED is disabled. Defaults to stun:stun.l.google.com:19302.
• PEERJS_HOST – Hostname or IP address of the self-hosted PeerJS server. Defaults to 0.peerjs.com.
• PEERJS_PATH – Path to the self-hosted PeerJS server. Defaults to /.

How are my files sent? Files are sent directly from your browser to the downloader's browser over WebRTC. They never pass through any server. The uploader must keep their browser window open until the transfer is complete.

Can multiple people download my file at once? Yes. Share the link with as many people as you like.

How big can my files be? Very large. CheezyPizza streams files to the OPFS and the max file size is determined by the type of the browser and total disk size. (Check Browser Support Section above)

What happens if my download is interrupted? CheezyPizza saves your progress automatically. If the connection drops the download will resume from where it left off once the connection is restored.

How do I know my file wasn't corrupted in transit? After each file transfer completes, the uploader computes a SHA-256 hash and sends it to the downloader. CheezyPizza verifies the hash before offering the file for saving. If the hashes don't match, the file is flagged and discarded.

Can I password-protect my transfer? Yes. Set a password when uploading. Downloaders must enter it before downloading the file.

Are my files encrypted? Yes. All WebRTC communications are encrypted using DTLS.

Which browsers are supported? CheezyPizza works in all major modern browsers. See the Browser Support section above for feature-level detail.

CheezyPizza is released under the BSD 3-Clause license.

Based on FilePizza by Alex Kern and Neeraj Baid.