Privacy-first peer-to-peer file transfer for the web.
Shipri is being built around a small signaling surface and direct WebRTC data channels. File contents and metadata stay between peers; the backend coordinates room membership and connection setup without becoming a storage service.
Status: active development. The protocol, security model, deployment topology, and implementation roadmap are documented; the product is not presented as production-ready yet.
- Direct browser-to-browser file transfer
- End-to-end encryption with keys kept out of the signaling backend
- Bounded-memory chunking and backpressure for large files
- STUN/TURN fallback for real-world network conditions
- A self-hostable deployment with Docker, Caddy, and Coturn
- A simple two-person room model with explicit file requests
flowchart LR
A[Peer A browser] <-->|Encrypted WebRTC data channel| B[Peer B browser]
A -->|Room and signaling events| S[Socket.IO signaling server]
B -->|Room and signaling events| S
A -.->|Fallback relay| T[Coturn]
B -.->|Fallback relay| T
The signaling service never receives file contents, plaintext file metadata, the shared file board, or transfer progress.
- React and Vite
- WebRTC / RTCDataChannel
- Socket.IO and Express
- Web Crypto API
- Caddy and Coturn
- Docker Compose
client/- browser client and current product prototypeserver/- room and WebRTC signaling servicecoturn/- TURN configurationdocs/- protocols, security model, UX flows, testing strategy, deployment design, and implementation ticketsdocker-compose.yml- local stackdocker-compose.prod.yml- production-oriented services
Start with the documentation index for the canonical design decisions and implementation roadmap.
cd client
npm install
npm run devcd server
npm install
npm run devEnvironment templates are available in client/.env.example and server/.env.example.
Shipri's security model is documented before implementation so that cryptographic and privacy boundaries are explicit. See:
Apache License 2.0. See LICENSE.