Security design
File contents are encrypted on your device and remain unreadable in transit.
TunnelTransfer is built around end-to-end encryption. Every send operation creates a fresh AES-GCM key. Files are split into chunks, each chunk is encrypted, and the receiver decrypts them only with the correct key.
Key handling
The encryption key is generated locally and carried inside the share code. The signaling service does not need the key. The peer ID connects devices; the key decrypts chunks.
Encryption
The web version uses the Web Crypto API with AES-GCM 256-bit keys. AES-GCM protects confidentiality and integrity: altered encrypted data fails to decrypt.
Transport layer
WebRTC data channels use the browser's secure transport mechanisms. TunnelTransfer adds its own file encryption on top, creating independent transport and content protection layers.
Signaling
PeerJS signaling helps devices discover each other. Signaling alone cannot decrypt file contents. Without the exact share code, encrypted chunks are not meaningful.
Multiple files
When several files are selected, the ZIP is created on the sender device. That ZIP is then encrypted and transferred like a normal file.
Responsible use
The share code is the sensitive part. Do not post it publicly, leave it visible in screenshots, or share it through an untrusted channel for sensitive files.