A short route, with clear boundaries.

Encrypted in transit. Direct WebRTC data channels use DTLS. If that route cannot be established, the existing WSS connection relays the transfer over TLS. The relay terminates TLS at Cloudflare and does not provide end-to-end encryption against Cloudflare.

Verified on arrival. The receiver calculates a SHA-256 fingerprint and accepts the transfer only when it matches the sender's fingerprint.

One live receiver. The first accepted receiver owns the active session. The sender can revoke availability by closing or resetting the page.

A small amount of signalling data is required to let both browsers find each other. This includes the transfer identifier, connection offers, and network candidates. Transfer in Seconds uses its own short-lived connection rooms on Cloudflare.

The file payload normally takes the direct WebRTC route. When that fails, the room forwards file blocks in memory to the other open browser and does not write them to storage. Network providers can process operational metadata such as IP addresses and connection timing because that is necessary to establish and route a connection.

The share link and short receive code work like temporary secrets: anyone who receives one may attempt to connect while both browsers are open. Use a trusted channel and compare the displayed safety code when identity matters.

Because file contents are not uploaded to our server, we cannot scan them for malware or enforce data-loss-prevention rules. Only accept files you expect, and follow your organisation's security policy.

Please send a clear description, reproduction steps, and potential impact to hello@transferinseconds.com. Do not access other people's data, degrade the service, or use social engineering while testing.