MeghXL turns one computer into a private file-transfer hub for your local network. Drop a file on one device and every other device on the same Wi-Fi can grab it from a browser, by link or QR — no app on the receiving device, no account, no cloud, no size limit.
This is the first public release.
Download
| Platform | File |
|---|---|
| macOS (Apple Silicon) | MeghXL_1.0.0_aarch64.dmg |
| macOS (Intel) | MeghXL_1.0.0_x64.dmg |
| Windows 10/11 (x64) | MeghXL_1.0.0_x64-setup.exe or MeghXL_1.0.0_x64_en-US.msi |
| Linux (x64) | MeghXL_1.0.0_amd64.AppImage, .deb, or .rpm |
Only the computer acting as the hub needs an installer. Everything else — phones, laptops, tablets — just opens the URL. Each installer is self-contained; there is no Node.js or other runtime to install.
What's in it
- Live shared board. A file dropped on one device appears on every open dashboard within a second, over WebSocket.
- Public or private, per file. Private files never appear in anyone's list — only their unguessable link works.
- Auto-expiry and one-time links. Share something that deletes itself after a set time, or the moment it is downloaded once.
- Shared message board for everyone on the network, plus private device-to-device messages.
- Any size. Uploads stream to disk and downloads support HTTP Range, so transfers resume and the only limit is your disk.
- Friendly name. Reachable at
http://meghxl.local:3000— bookmark once per device. - Host console at
/adminfor the device roster, blocking, announcements and file management, restricted to the machine running the server. - Desktop app with a tray icon, start-at-login, a downloads folder you choose, and in-app updates.
- LAN-only by design. MeghXL never exposes itself to the internet. For remote access, put it behind your own VPN or authenticated proxy and set
PUBLIC_BASE_URL.
Installing
These builds are not notarized by Apple or signed with a Windows certificate, so the first launch shows a warning:
- macOS — right-click the app and choose Open, then confirm.
- Windows — More info → Run anyway on the SmartScreen prompt.
Building from source avoids both.
This is separate from update signing: every artifact here is cryptographically signed with the project's updater key, and the app installs an update only if the signature verifies against the public key compiled into it. A tampered download is refused.
Privacy
MeghXL makes exactly one outbound request in its entire lifetime, and only when you press Check for updates: a single GET to the GitHub releases API to compare version numbers. No identifiers, no filenames, no usage data, nothing on a timer. Delete src/routes/update.js if you want even that gone.
Verifying a download
Every installer ships with a matching .sig. To check one, install the Tauri CLI and run:
npx @tauri-apps/cli signer verify -f MeghXL_1.0.0_x64.dmgFull details in the README · threat model in SECURITY.md · changes in CHANGELOG.md.
Apache-2.0. A matily.org product.