How BeamDrop works
BeamDrop connects your browser directly to the recipient’s and streams the files between you. Here is what happens at each step, and what our server does (very little).
1. You choose files — nothing is uploaded
When you drop files or a folder onto the box, your browser only reads their names and sizes so it can show the list. The files stay on your device. Your browser then opens a connection to BeamDrop’s signaling server and asks for a new room. The server answers with two things: a random 128-bit room ID, which becomes the link, and a short 6-character code for people who would rather type than click.
The server does not learn what you are sending. It never receives the file list — that is shared later, directly with the recipient.
2. The recipient opens the link
The link looks like wetransfertool.com/r/…. When the recipient opens it (or enters the code on the home page), their browser asks the server to join your room. The server tells your browser someone has arrived, and from that moment its only job is to pass a handful of small messages back and forth so the two browsers can find each other.
Those messages are the standard WebRTC “offer”, “answer” and ICE candidates: descriptions of how each browser can be reached (network addresses and ports) and the fingerprint of each side’s encryption certificate. To discover your public address, each browser asks a public STUN server — Google’s or Cloudflare’s — “what address do you see me as?”. STUN servers answer that question and nothing more.
3. A direct, encrypted connection opens
With those details exchanged, the browsers try to reach each other directly, testing several network paths until one works. On the same Wi-Fi this is usually a local address inside your home or office; across the internet it is the public address each router presents. The resulting connection is a WebRTC data channel, encrypted with DTLS — the same protection your browser uses for video calls.
Both screens then show a security check: five symbols calculated from the two encryption fingerprints. If they match on both screens, no one has slipped in between you. If they ever differ, stop and start over.
Sometimes a direct path is impossible: certain corporate firewalls, carrier-grade NAT on some mobile networks, or VPNs can block it. Many services handle that by relaying traffic through their own servers (a “TURN relay”). BeamDrop deliberately does not, because that would mean your files flowing through our machines. Instead you will see a clear message with things to try, like moving both devices to the same Wi-Fi or switching one to a mobile hotspot.
4. The recipient accepts, and the files stream
The file list travels over the encrypted channel, so the recipient sees names and sizes before anything downloads. They choose Download for a single file, Save next to any file, or Download all (.zip), which builds the zip on the fly in their browser — folder structure included.
Your browser reads each file in small pieces (typically 64–256 KB), sends them in order and slows down whenever the channel or the recipient’s disk is busy, so neither side runs out of memory. Where the browser allows it, data is written to disk as it arrives:
| Browser | Where incoming data goes |
|---|---|
| Chrome, Edge (computer) | Straight to the file you choose in the save dialog |
| Firefox, Chrome on Android | Streamed into your Downloads folder by a small service worker |
| Safari (Mac, iPhone, iPad) | Temporary browser storage on disk, then saved to Downloads |
| Older browsers | Memory, then saved — fine for files up to roughly a gigabyte |
5. Every file is verified
While sending, your browser computes a SHA-256 checksum of each file. The recipient’s browser computes its own from the bytes it actually received and compares the two. Each file is then marked “SHA-256 verified”, or flagged if anything went wrong, and the result shows on both screens.
6. You close the tab — and it’s over
Pressing Stop sharing or closing your tab deletes the room on the server immediately. Unused rooms expire after 24 hours. There are no files to delete, because none were ever stored.
Limits worth knowing
- Both devices must be online at the same time, with the sender’s tab open.
- One recipient downloads at a time; others can use the same link afterwards.
- Transfers cannot be paused or resumed yet. If a connection drops, start the download again.
- Phones pause background tabs, so keep BeamDrop on screen during a transfer.
For the technical background, read how peer-to-peer file transfer works, and for what we can and cannot see, Security & privacy.