Fast, encrypted file sharing for your local network.
No cloud. No accounts. No size limits. Devices find each other automatically and transfer files directly - encrypted end to end.
⬇ Download the latest release - Windows installer, macOS dmg, Linux AppImage/deb/rpm
| 🔍 Zero-config discovery | Devices running Bliink find each other automatically on your LAN - no IP addresses, no pairing codes to type |
| 🔐 Encrypted by default | Every transfer negotiates a fresh X25519 key exchange and streams over AES-256-GCM |
| 🛡️ Verification codes | Both screens show a 6-digit code derived from the session key - if they match, nobody is intercepting |
| ✋ Consent first | Incoming files prompt before a single byte lands on disk (auto-accept is opt-in) |
| ✅ Verified delivery | SHA-256 checked on the receiver before the sender ever sees "completed" |
| 📁 Folder & batch transfers | Send whole directory trees or multi-file selections as one batch with a single prompt |
| 🖼️ Live previews | Thumbnails for images, videos and documents - receivers see what's coming before accepting |
| 🗂️ Collapsible groups | Batches roll up into expandable group cards with aggregate progress on both ends |
| ⏯️ Full transfer control | Pause, resume and cancel from either side |
| 🕓 Transfer history | Searchable, filterable history stored locally in SQLite |
| 🔔 Native notifications | Toasts for incoming requests and finished transfers |
| 💬 Built-in chat | WhatsApp-style messaging with attachments, voice notes, replies, read receipts and typing indicators - all over the same encryption |
| 📞 Audio calls | Call any device on your network - WebRTC, no servers involved |
| 🌍 Works over the internet | Add a device by its Bliink ID - direct P2P with NAT hole punching, encrypted relay fallback, zero setup |
Screenshots coming soon.
Grab an installer from the releases page. Windows is the primary platform; macOS and Linux builds are experimental (macOS builds are unsigned - right-click → Open the first time).
Bliink discovers devices on your LAN automatically. For devices elsewhere, open Devices → Add Device → Over the internet and paste the other device's Bliink ID (shown under Settings → Remote Access). Connections punch through NATs directly when possible and fall back to an encrypted relay (iroh) otherwise - transfers, chat, and calls all work, end-to-end encrypted either way. Prefer your own network path? The IP address / VPN mode works with Tailscale IPs or port forwarding.
- Rust (stable)
- Node.js 20+ and pnpm
- Platform setup from the Tauri prerequisites guide
git clone https://github.com/tedydonel/Bliink.git
cd Bliink
pnpm install
pnpm tauri devpnpm tauri buildInstallers land in src-tauri/target/release/bundle/.
Note: Bliink talks over UDP port 9001 (discovery) and a dynamic TCP port (transfers). If Windows Firewall prompts you, allow access on private networks - or run
setup-firewall.ps1as administrator.
Bliink is designed so that using it casually is safe, and using it carefully is verifiably safe:
- Ephemeral encryption - every connection performs an X25519 Diffie-Hellman exchange; data flows in AES-256-GCM frames with per-direction nonces. Keys live only as long as the transfer.
- Man-in-the-middle detection - both sides derive a 6-digit code from the session key. An interceptor ends up with two different sessions, so the codes won't match. Enable Require Code Check in settings to make confirming this mandatory before accepting.
- Consent gate - incoming transfers are declined automatically unless you accept within 60 seconds. Folder batches prompt once for the whole batch.
- Tamper-proof delivery - receivers hash incrementally and only acknowledge after verification; partial/failed downloads are cleaned up (
.partfiles), never left masquerading as the real thing. - Path traversal protection - sender-supplied names are sanitized component-by-component; a malicious peer can't write outside your download folder.
Known limitation: the key exchange itself is unauthenticated (that's what the verification codes mitigate). PIN-bound pairing is on the roadmap.
┌────────────────────────┐ UDP broadcast (:9001) ┌────────────────────────┐
│ Bliink (Device A) │ ◄───────── discovery ───────────► │ Bliink (Device B) │
│ │ │ │
│ Next.js UI (WebView) │ TCP, dynamic port │ Next.js UI (WebView) │
│ Rust core (Tauri 2) │ ◄═══ X25519 + AES-256-GCM ════════► │ Rust core (Tauri 2) │
└────────────────────────┘ encrypted frames └────────────────────────┘
| Layer | Tech | Source |
|---|---|---|
| UI | Next.js 16 (static export), Tailwind 4, Zustand | app/ |
| Device discovery | UDP broadcast + presence pruning | src-tauri/src/discovery.rs |
| Transfer engine | Batching, consent, pause/cancel, acks | src-tauri/src/transfer.rs |
| Encryption | X25519 handshake, AES-256-GCM framing, SAS codes | src-tauri/src/crypto.rs |
| Previews | Windows Shell thumbnails + pure-Rust fallback | src-tauri/src/thumbs.rs |
| History | Embedded SQLite | src-tauri/src/history.rs |
| Settings | JSON in app data dir, stable device identity | src-tauri/src/config.rs |
The wire protocol is versioned by release - both devices should run the same version.
- Encrypted transfers with verification codes
- Consent prompts & auto-accept setting
- Folder / multi-file batches with single prompt
- File previews (sender and receiver, before accepting)
- Collapsible batch groups
- Transfer history (SQLite) & desktop notifications
- 💬 Built-in chat (text, attachments, voice notes, receipts, typing)
- 📞 Audio calls over the LAN
- 🌍 Remote devices by address (VPN / port-forward friendly)
- 🛰️ True internet P2P - connect by Bliink ID with hole punching + relay fallback
- 🔗 PIN-bound device pairing
- 📡 mDNS discovery
Issues and pull requests are welcome! For larger changes, please open an issue first to discuss the direction.
pnpm exec tsc --noEmit # type-check the frontend
cargo check # check the backend (run in src-tauri/)
cargo test # run backend testsThis project is licensed under the MIT License.