Iriszip: encrypted P2P file transfer in the browser with no accounts or uploads

A developer has released Iriszip, a file-transfer tool that works entirely inside the browser and moves data straight from one device to another, with no accounts, no uploads to a central service, and nothing to install. The project was announced in a post on dev.to and is the work of a single author, who notes that it has only recently become public.

The motivation, according to the developer, was simple: an easy way to get a file from one device to another without installing an app, signing up anywhere, or parking the file on a server first.

How a transfer works

Both devices open the Iriszip site. One scans a QR code or types in a nine-digit pairing code, after which files or plain text can be sent from the browser. The path the data takes depends on where the two devices are, according to the dev.to announcement. On the same local network, transfers can remain device-to-device and run at LAN speed. Over the internet, Iriszip first tries a direct WebRTC link between the two browsers and only falls back to a relay when a direct connection cannot be established — the situation many people hit behind restrictive routers and locked-down corporate networks. The developer emphasises that only ciphertext ever passes through that relay.

Encryption and what the server touches

Traffic is encrypted end to end, and the developer writes that the cryptographic protocol design went through an independent security review, adding that the security side of the project grew far larger than originally expected. As for the server side: no file or message content is written to disk, relayed data lives in memory only while a transfer is in progress, and session state is discarded once the session finishes.

Open source, and self-hostable

All three components are open source, with a deliberate licence split: the browser client is MIT-licensed, the cryptographic core is Apache-2.0, and the server is AGPL-3.0. The server can be self-hosted with Docker Compose, so a team can run its own instance rather than depending on the hosted service at iriszip.com. The code is published on GitHub in the iris-zip/iris repository.

The developer is frank about maturity: it remains a solo project, it has just gone live, and the author is explicitly asking for feedback from people who work with WebRTC, cryptography, networking, privacy, or self-hosted software — including reports of anything broken or parts of the design that could be done better.

Why it matters

Most consumer file-sharing services use an upload model: the file sits on third-party infrastructure until the recipient downloads it. Iriszip's peer-to-peer approach keeps the payload between the two endpoints, and in the cases where a server has to sit in the path, that server sees only encrypted bytes and stores nothing. That reduces both the trust the parties must extend to the operator and the exposure of content to a third party.

The AGPL-licensed server plus Docker Compose support also means the relay does not have to belong to someone else. An organisation can stand up its own instance and keep the entire flow under its control, which is rarely an option with hosted transfer services.

There are honest caveats. This is a one-person project at an early stage, the independent security review is asserted in the announcement rather than documented in detail there, and newly written cryptographic code generally deserves outside scrutiny before being trusted with sensitive transfers. The author appears aware of this and is asking for exactly that kind of examination — and with every component open source, reviewers have what they need to provide it.