Any file, to anyone, anywhere.
Free and open source. End-to-end encrypted. No email, no phone number, no account.
Website · Download · Roadmap · Donate · Releases
العربية · বাংলা · Čeština · Dansk · Deutsch · Ελληνικά · English · Español · فارسی · Suomi · Français · עברית · हिन्दी · Magyar · Bahasa Indonesia · Italiano · 日本語 · 한국어 · Bahasa Melayu · Norsk bokmål · Nederlands · Polski · Português (Brasil) · Português (Portugal) · Română · Русский · Svenska · Kiswahili · ไทย · Türkçe · Українська · اردو · Tiếng Việt · 简体中文 · 繁體中文
Why TotalDrop
- A short code is all it takes. Pick files and get a code like
7-harbor-rocket. Read it out or show the QR code; the other person types it in and the files arrive.
- Encrypted end to end, and you can check it. Both screens show the same four words before anything moves. If they differ, stop.
- Nothing to sign up for. No account, email or phone number. Optional accounts will be numbers only, Mullvad-style (design).
- Straight from device to device, anywhere. The rendezvous server only introduces the two devices and keeps no logs; like any server, it sees their IP addresses. Devices connect directly across the internet wherever they can. When a router or firewall is in the way, a relay carries traffic it cannot read.
- At home on your system. The apps follow the system's light or dark theme, accent colour, language and reduced-motion setting. The Linux app is native Qt 6 on Wayland and also takes its fonts, corners and icons from KDE Plasma, Hyprland and Omarchy themes, live.
- Free, for good. Open source and funded by donations. No ads, no tracking, no paid tier for the basics.
Download
| Platform | Get it | Notes |
|---|
| Linux (x86-64) | Arch / Omarchy · Debian / Ubuntu · Fedora | 0.3.0-beta.1, Qt 6.8 or newer |
| Linux (ARM64) | Debian / Ubuntu · Fedora | 0.3.0-beta.1, Qt 6.8 or newer |
| Android | Join the beta | 0.3.0-beta.1, Android 15 or newer, Google Play by invitation |
| Command line | cargo install --git https://github.com/totaldrop-app/totaldrop totaldrop-cli | Linux, macOS, Windows |
| Windows, macOS, iOS | Coming | Code signing for these is what donations pay for first |
Every package is built by CI from a tagged commit, never on a developer's machine. To check one before installing it, compare it with the release's SHA256SUMS and verify where it was built:
gh attestation verify totaldrop_0.3.0.beta.1-1_amd64.deb --repo totaldrop-app/totaldrop
[!NOTE]
Beta. The code has not had an independent security review yet, so please don't rely on it for sensitive files.
How it works
- The sender asks the rendezvous server for a short code. The code is the only secret the two people share.
- Both devices turn the code into a strong key with CPace. An attacker gets one guess per transfer and cannot test codes offline.
- They connect directly over QUIC (TLS 1.3 with pinned raw public keys) and run Noise XXpsk3 with ML-KEM-768, which is designed to hold up against future quantum computers.
- Files are encrypted in chunks (STREAM), so every piece is authenticated as it arrives.
The protocol is described in TotalDrop Protocol v0. Decisions made while implementing it are in docs/protocol-v0.1-notes.md, and what each server can and cannot see is in the threat model (Turkish) and the privacy policy.
In your language
TotalDrop speaks 35 languages and follows your region's number formats. English and Turkish are reviewed; the other 33 are drafts that native speakers are checking, so the apps keep the security texts (verification, wrong code, accept and decline) in English until a language is reviewed. The site and the apps have them all, from Android and Linux 0.3.0-beta.1.
Spotted a clumsy sentence? Help translate (the guide is in Turkish).
Support the project
TotalDrop stays free because people chip in. Donations pay for the relay, the code-signing certificates that Windows and macOS require, and an independent security audit before 1.0. Every cost, line by line, and what has been raised so far: totaldrop.app/donate.
You can also help by reporting bugs, translating, or testing on your desktop.
For developers
Repository layout
| Path | What it is | License |
|---|
crates/totaldrop-crypto | Suite TD0: CPace, key derivation, mailbox and session encryption, device keys, STREAM chunk encryption | MIT OR Apache-2.0 |
crates/totaldrop-proto | Transfer codes, limits, path safety, every wire message (CBOR) | MIT OR Apache-2.0 |
crates/totaldrop-core | Client engine: rendezvous, QUIC with raw public keys, Noise XXpsk3 + ML-KEM-768, transfer | MIT OR Apache-2.0 |
crates/totaldrop-l10n | Interface text for the Rust programs: language negotiation, ICU messages, plurals, regional numbers | MIT OR Apache-2.0 |
crates/totaldrop-cli | The totaldrop command-line client | GPL-3.0-or-later |
l10n/ | Every interface string, shared by Android, Linux and the CLI (translating) | GPL-3.0-or-later |
linux/ | Linux desktop app: Qt 6 and QML over totaldrop-core, native Wayland | GPL-3.0-or-later |
packaging/ | Linux packages, each format on its own: Arch (PKGBUILD), Debian (debian/), RPM (.spec) | GPL-3.0-or-later |
app/ | Android app (Flutter); iOS later | GPL-3.0-or-later |
site/ | totaldrop.app, download.totaldrop.app and the page QR links open | GPL-3.0-or-later; fonts SIL OFL 1.1 |
fuzz/ | Fuzz targets for every parser | MIT OR Apache-2.0 |
server/totaldrop-rendezvous | Rendezvous server in Rust, for self-hosting and tests | AGPL-3.0-or-later |
server/rendezvous-worker | The same server on Cloudflare Workers, for rendezvous.totaldrop.app | AGPL-3.0-or-later |
The libraries are permissive so anyone can build on the protocol; the apps are GPL and the servers AGPL. See LICENSING.md.
Each platform has its own version, tag (linux-v…, android-v…) and CI workflow, so one can ship without touching the others. How branches and releases work: docs/gelistirme.md (Turkish) and docs/versioning.md. Design rules: docs/tasarim.md and architecture decisions: docs/kararlar, both in Turkish.
Build
cargo test
cargo build --release
Try a transfer on one machine, in three terminals:
# 1. a local rendezvous server
./target/release/totaldrop-rendezvous 127.0.0.1:4000
# 2. the sender prints a code such as 3-harbor-rocket
TOTALDROP_SERVER=ws://127.0.0.1:4000 ./target/release/totaldrop send ./photos
# 3. the receiver
TOTALDROP_SERVER=ws://127.0.0.1:4000 ./target/release/totaldrop receive 3-harbor-rocket
Both sides show the same four verification words. Unencrypted ws:// is accepted only for a server on the same machine; anything else must be wss://.
The project always targets the newest stable Rust (pinned in rust-toolchain.toml); rustup installs it on the first build.
Linux app (needs Qt 6.8 or newer: qt6-base, qt6-declarative, qt6-wayland, qt6-svg):
cargo run --release -p totaldrop-linux
packaging/build.sh arch # or deb, rpm: a package in dist/packages/, built in a container
Contributing and security
Read CONTRIBUTING.md before opening a pull request, and our code of conduct. Questions go to SUPPORT.md. Please report vulnerabilities privately as described in SECURITY.md, never in a public issue.
