Skip to content

Repository files navigation

Bliink logo

Bliink

Fast, encrypted file sharing for your local network.

No cloud. No accounts. No size limits. Devices find each other automatically and transfer files directly - encrypted end to end.

License: MIT Latest Release Built with Tauri Next.js Rust PRs Welcome

⬇ Download the latest release - Windows installer, macOS dmg, Linux AppImage/deb/rpm


✨ Features

🔍 Zero-config discovery Devices running Bliink find each other automatically on your LAN - no IP addresses, no pairing codes to type
🔐 Encrypted by default Every transfer negotiates a fresh X25519 key exchange and streams over AES-256-GCM
🛡️ Verification codes Both screens show a 6-digit code derived from the session key - if they match, nobody is intercepting
Consent first Incoming files prompt before a single byte lands on disk (auto-accept is opt-in)
Verified delivery SHA-256 checked on the receiver before the sender ever sees "completed"
📁 Folder & batch transfers Send whole directory trees or multi-file selections as one batch with a single prompt
🖼️ Live previews Thumbnails for images, videos and documents - receivers see what's coming before accepting
🗂️ Collapsible groups Batches roll up into expandable group cards with aggregate progress on both ends
⏯️ Full transfer control Pause, resume and cancel from either side
🕓 Transfer history Searchable, filterable history stored locally in SQLite
🔔 Native notifications Toasts for incoming requests and finished transfers
💬 Built-in chat WhatsApp-style messaging with attachments, voice notes, replies, read receipts and typing indicators - all over the same encryption
📞 Audio calls Call any device on your network - WebRTC, no servers involved
🌍 Works over the internet Add a device by its Bliink ID - direct P2P with NAT hole punching, encrypted relay fallback, zero setup

📸 Screenshots

Screenshots coming soon.

🚀 Getting Started

Install

Grab an installer from the releases page. Windows is the primary platform; macOS and Linux builds are experimental (macOS builds are unsigned - right-click → Open the first time).

Connect over the internet

Bliink discovers devices on your LAN automatically. For devices elsewhere, open Devices → Add Device → Over the internet and paste the other device's Bliink ID (shown under Settings → Remote Access). Connections punch through NATs directly when possible and fall back to an encrypted relay (iroh) otherwise - transfers, chat, and calls all work, end-to-end encrypted either way. Prefer your own network path? The IP address / VPN mode works with Tailscale IPs or port forwarding.

Prerequisites (building from source)

Run from source

git clone https://github.com/tedydonel/Bliink.git
cd Bliink
pnpm install
pnpm tauri dev

Build a release bundle

pnpm tauri build

Installers land in src-tauri/target/release/bundle/.

Note: Bliink talks over UDP port 9001 (discovery) and a dynamic TCP port (transfers). If Windows Firewall prompts you, allow access on private networks - or run setup-firewall.ps1 as administrator.

🛡️ Security Model

Bliink is designed so that using it casually is safe, and using it carefully is verifiably safe:

  1. Ephemeral encryption - every connection performs an X25519 Diffie-Hellman exchange; data flows in AES-256-GCM frames with per-direction nonces. Keys live only as long as the transfer.
  2. Man-in-the-middle detection - both sides derive a 6-digit code from the session key. An interceptor ends up with two different sessions, so the codes won't match. Enable Require Code Check in settings to make confirming this mandatory before accepting.
  3. Consent gate - incoming transfers are declined automatically unless you accept within 60 seconds. Folder batches prompt once for the whole batch.
  4. Tamper-proof delivery - receivers hash incrementally and only acknowledge after verification; partial/failed downloads are cleaned up (.part files), never left masquerading as the real thing.
  5. Path traversal protection - sender-supplied names are sanitized component-by-component; a malicious peer can't write outside your download folder.

Known limitation: the key exchange itself is unauthenticated (that's what the verification codes mitigate). PIN-bound pairing is on the roadmap.

🏗️ Architecture

┌────────────────────────┐        UDP broadcast (:9001)        ┌────────────────────────┐
│  Bliink (Device A)     │ ◄─────────  discovery  ───────────► │  Bliink (Device B)     │
│                        │                                     │                        │
│  Next.js UI (WebView)  │        TCP, dynamic port            │  Next.js UI (WebView)  │
│  Rust core (Tauri 2)   │ ◄═══ X25519 + AES-256-GCM ════════► │  Rust core (Tauri 2)   │
└────────────────────────┘         encrypted frames            └────────────────────────┘
Layer Tech Source
UI Next.js 16 (static export), Tailwind 4, Zustand app/
Device discovery UDP broadcast + presence pruning src-tauri/src/discovery.rs
Transfer engine Batching, consent, pause/cancel, acks src-tauri/src/transfer.rs
Encryption X25519 handshake, AES-256-GCM framing, SAS codes src-tauri/src/crypto.rs
Previews Windows Shell thumbnails + pure-Rust fallback src-tauri/src/thumbs.rs
History Embedded SQLite src-tauri/src/history.rs
Settings JSON in app data dir, stable device identity src-tauri/src/config.rs

The wire protocol is versioned by release - both devices should run the same version.

🗺️ Roadmap

  • Encrypted transfers with verification codes
  • Consent prompts & auto-accept setting
  • Folder / multi-file batches with single prompt
  • File previews (sender and receiver, before accepting)
  • Collapsible batch groups
  • Transfer history (SQLite) & desktop notifications
  • 💬 Built-in chat (text, attachments, voice notes, receipts, typing)
  • 📞 Audio calls over the LAN
  • 🌍 Remote devices by address (VPN / port-forward friendly)
  • 🛰️ True internet P2P - connect by Bliink ID with hole punching + relay fallback
  • 🔗 PIN-bound device pairing
  • 📡 mDNS discovery

🤝 Contributing

Issues and pull requests are welcome! For larger changes, please open an issue first to discuss the direction.

pnpm exec tsc --noEmit   # type-check the frontend
cargo check              # check the backend (run in src-tauri/)
cargo test               # run backend tests

📄 License

This project is licensed under the MIT License.

About

⚡ Fast, encrypted file sharing for your local network — no cloud, no accounts. Auto-discovery, AES-256-GCM transfers, verification codes, folder batches & live previews. Built with Tauri 2 + Next.js.

Topics

Resources

Stars

4 stars

Watchers

0 watching

Forks

Releases

Packages

Contributors

Languages