Files between your computer and your phone. Nothing in between.

The problem

Moving a file three metres should not need a server in another country

Getting a file from a Windows PC onto an iPhone is solved everywhere except between those two devices. AirDrop stops at the edge of Apple's ecosystem. A cable wants software and still argues about file types. Everything else uploads your file to somebody's datacentre so it can travel across the room.

How it works

One server, one socket, both directions

Metadata travels as JSON text frames and file bytes as binary frames on the same WebSocket. Each chunk is written straight to disk and hashed as it goes, so memory does not grow with the file.

   Your computer                                Phone or tablet
┌────────────────────┐                        ┌────────────────────┐
│  python -m         │                        │                    │
│    airbridge       │   1. scan the QR code  │  Camera app        │
│                    │ ─────────────────────► │       │            │
│  ┌──────────────┐  │                        │       ▼            │
│  │ aiohttp      │  │   2. TLS 1.3 handshake │  ┌──────────────┐  │
│  │  HTTPS + WSS │◄─┼────────────────────────┼─►│ Any modern   │  │
│  │              │  │      AES-256-GCM       │  │  browser -   │  │
│  │  PIN auth    │  │                        │  │  no install  │  │
│  │  SHA-256     │  │   3. 64 KB chunks,     │  └──────────────┘  │
│  └──────┬───────┘  │      either direction, │                    │
│         │          │      resumable         │                    │
│  ~/Downloads/      │   4. mDNS announce     │                    │
│    AirBridge_...   │ ◄──────────────────────┤  airbridge.local   │
└────────────────────┘                        └────────────────────┘
         └─ your router, or the phone's own hotspot ─┘
                     no path to the internet

• Interrupted transfers continue. An upload lands in a scratch file named for its declared size and is renamed into place only once whole. Reconnecting reports how many bytes survived; the phone sends the rest.
• Both ends hash independently. The browser computes SHA-256 as it sends and receives and compares against the server's digest, so a transfer reads Verified rather than merely Complete. A download that fails the check is discarded instead of handed over.
• Wrong PINs get expensive. Five failures in a minute lock that address out, doubling on repeat. Six digits is a million guesses and nothing was slowing them down.

Alternatives

Where this actually sits

The idea of a small LAN server with a QR code is not new, and there are good tools either side of this one. The combination is what is thin on the ground: nothing installed on the phone, nothing outside the network, and a session that behaves like an app.

The hard part

Why a thing on your own network bothers with HTTPS

Not for the padlock. Browsers keep half their capabilities behind a secure context: on a plain http://192.168.x.x page, crypto.subtle is undefined and navigator.serviceWorker does not exist. Offline caching is impossible before you write a line of it. TLS also stops anyone else on the café Wi-Fi reading your file.

Install the certificate once and the warnings stop for good. Open /ca.crt on the phone, then Settings → Profile Downloaded → Install, then Settings → General → About → Certificate Trust Settings. The terminal prints its SHA-256 fingerprint so you can check it is your machine and nobody else's.

Devices

Anything with a browser

The iPhone is what this was built for and the strictest case to satisfy, but nothing in the design is specific to it. Each of these was put through a real transfer, not read off the code.

† After the certificate is installed. Without it Safari falls back to the unencrypted port, where browsers disable offline caching.

Install

Two lines

$ pip install git+https://github.com/nkVas1/AirBridge
$ airbridge

Or take the release — a wheel, a source tarball and a zip, each with its SHA-256 in the notes. From a checkout, start.bat on Windows and start.sh elsewhere build a virtual environment first.

Honestly

What it does not do

Named here rather than discovered later.

• Downloads do not resume. Uploads do. A file pulled from the computer to the phone starts over if the connection drops.
• One PIN, one person. No separate users, and anyone with the PIN sees everything in the downloads folder.
• The PIN rides in the pairing link. That is what makes the QR code work in a stock camera app. The page strips it from the address bar after connecting, but query strings leak.
• The certificate needs installing for a warning-free encrypted connection. One tap, once per device, and it is a private authority living on your machine — remove it in Certificate Trust Settings whenever you like.
• mDNS is best-effort. airbridge.local does not resolve on every network; the numeric address always works.
• 10 GB per file, and files only — no directory upload.
• Nothing here has been security-audited. It is one person's tool, published as-is.