TotalDrop
Any file, to anyone, anywhere.
Free, open source, end-to-end encrypted. No email, no phone number, no account.
Why TotalDrop
- A short code is all it takes. Pick files, get a code like
7-harbor-rocket, read it out or show the QR. The other side types it and the files arrive. - Encrypted end to end, checked by you. Both screens show the same four words before anything moves. If they differ, stop.
- Nothing to sign up for. No account, email or phone number. Optional accounts will be numbers only, Mullvad-style (design).
- Straight from device to device, anywhere. The rendezvous server only introduces the two devices and keeps no logs. Devices connect directly across the internet wherever they can; when a router or firewall is in the way, the relay carries traffic it cannot read.
- At home on your desktop. The Linux app is native Qt 6 and Wayland and follows your theme on KDE Plasma, Hyprland and Omarchy, live.
- Free, for good. Open source and funded by donations. No ads, no tracking, no paid tier for the basics.
The Linux app takes its colours, corners and icons from the desktop: here TotalDrop's own theme and an Omarchy theme.
Download
| Platform | Get it | Notes |
|---|---|---|
| Linux | Arch / Omarchy · Debian / Ubuntu · Fedora | Qt 6.8 or newer, x86-64 |
| Android | Join the beta | Android 15 or newer, on Google Play by invitation |
| Command line | cargo install --git https://github.com/totaldrop-app/totaldrop totaldrop-cli |
Linux, macOS, Windows |
| Windows, macOS, iOS | Coming | Signing for these is what donations pay for first |
Every Linux release carries a SHA256SUMS file.
Note
Beta. The code has not had an independent security review yet, so please don't rely on it for sensitive files.
How it works
- The sender asks the rendezvous server for a short code. The code is the only secret the two people share.
- Both devices turn the code into a strong key with CPace: an attacker gets a single guess per transfer and cannot test codes offline.
- They connect directly over QUIC (TLS 1.3 with pinned raw public keys) and run Noise XXpsk3 with ML-KEM-768, which stays safe against future quantum computers.
- Files are encrypted in chunks (STREAM), so every piece is authenticated as it arrives.
The protocol is written down in TotalDrop Protocol v0; decisions made while implementing it are in docs/protocol-v0.1-notes.md.
Support the project
TotalDrop stays free because people chip in. Donations pay for the relay, the code-signing certificates Windows and macOS demand, and an independent security audit before 1.0. Every cost, line by line, and what has been raised so far: totaldrop.app/donate.
You can also help by reporting bugs, translating, or testing on your desktop.
For developers
Repository layout
| Path | What it is | License |
|---|---|---|
crates/totaldrop-crypto |
Suite TD0: CPace, key derivation, mailbox and session encryption, device keys, STREAM chunk encryption | MIT OR Apache-2.0 |
crates/totaldrop-proto |
Transfer codes, limits, path safety, every wire message (CBOR) | MIT OR Apache-2.0 |
crates/totaldrop-core |
Client engine: rendezvous, QUIC with raw public keys, Noise XXpsk3 + ML-KEM-768, transfer | MIT OR Apache-2.0 |
crates/totaldrop-l10n |
Interface text for the Rust programs: language negotiation, ICU messages, plurals, regional numbers | MIT OR Apache-2.0 |
crates/totaldrop-cli |
The totaldrop command-line client |
GPL-3.0-or-later |
l10n/ |
Every interface string, shared by Android, Linux and the CLI (translating) | GPL-3.0-or-later |
linux/ |
Linux desktop app: Qt 6 and QML over totaldrop-core, native Wayland |
GPL-3.0-or-later |
packaging/ |
Linux packages, each format on its own: Arch (PKGBUILD), Debian (debian/), RPM (.spec) |
GPL-3.0-or-later |
app/ |
Android app (Flutter); iOS later | GPL-3.0-or-later |
site/ |
totaldrop.app, download.totaldrop.app and the page QR links open | GPL-3.0-or-later; fonts SIL OFL 1.1 |
fuzz/ |
Fuzz targets for every parser | MIT OR Apache-2.0 |
server/totaldrop-rendezvous |
Rendezvous server in Rust, for self-hosting and tests | AGPL-3.0-or-later |
server/rendezvous-worker |
The same server on Cloudflare Workers, for rendezvous.totaldrop.app |
AGPL-3.0-or-later |
The libraries are permissive so anyone can build on the protocol; the apps are GPL and the servers AGPL. See LICENSING.md.
Each platform has its own version, tag (linux-v…, android-v…) and CI workflow, so one can ship without touching the others. How branches and releases work: docs/gelistirme.md (Turkish) and docs/versioning.md. Design rules: docs/tasarim.md.
Build
cargo test
cargo build --release
Try a transfer on one machine, in three terminals:
# 1. a local rendezvous server
./target/release/totaldrop-rendezvous 127.0.0.1:4000
# 2. the sender prints a code such as 3-harbor-rocket
TOTALDROP_SERVER=ws://127.0.0.1:4000 ./target/release/totaldrop send ./photos
# 3. the receiver
TOTALDROP_SERVER=ws://127.0.0.1:4000 ./target/release/totaldrop receive 3-harbor-rocket
Both sides show the same four verification words. Unencrypted ws:// is accepted only for a server on the same machine; anything else must be wss://.
The project always targets the newest stable Rust (pinned in rust-toolchain.toml); rustup installs it on the first build.
Linux app (needs Qt 6.8 or newer: qt6-base, qt6-declarative, qt6-wayland, qt6-svg):
cargo run --release -p totaldrop-linux
packaging/build.sh arch # or deb, rpm: a package in dist/packages/, built in a container
Contributing and security
Read CONTRIBUTING.md before opening a pull request. Please report vulnerabilities privately as described in SECURITY.md, never in a public issue.
Türkçe
Her dosyayı, herkese, her yere. TotalDrop ücretsiz, açık kaynak ve uçtan uca şifreli bir dosya gönderme uygulamasıdır. E-posta, telefon numarası ya da hesap gerekmez: dosyaları seçin, 7-harbor-rocket gibi kısa bir kod alın, karşı taraf kodu yazsın. İki ekranda aynı dört kelime görünür; farklıysa durun.
Linux uygulaması KDE Plasma, Hyprland ve Omarchy temalarına canlı olarak uyar. Android sürümü Google Play'de kapalı beta olarak test ediliyor. Proje bağışlarla yaşıyor: GitHub Sponsors. Geliştirme düzeni için docs/gelistirme.md.
