Tools › Sharing › File transfer
File transfer
Phone to laptop, laptop to laptop, your machine to someone else's across the country. Open this page on both, read six characters off one screen, and the file goes straight from one device to the other.
- Works between networks, not only between devices on the same Wi-Fi
- No size limit on Chrome and Edge: the file is written to disk as it arrives, never held in memory
- A four-digit safety code on both screens, so you can see you are connected to each other and to nothing else
- Photos, video and audio play where they land; you only save the ones you want
…then type it on the other device. Or, if you already have a code:
Enter this code on the other device:
Or point the other device's camera at this: the link opens the page with the code already in it, and connects.
Safety code: this should read the same on both screens:
Drop a file anywhere on this page, or paste a screenshot.
These two devices cannot reach each other directly. Some office, campus and hotel networks block the kind of traffic this needs. Nothing is wrong with either machine.
There is another way through: a relay server that both devices can reach, which passes the file along. If you use it, the file no longer goes only between the two browsers, it travels through someone else's machine. It stays encrypted from one browser to the other the whole way, so the relay forwards bytes it cannot read, but it is no longer true that nothing touches a server.
Or move both devices onto the same network, a phone hotspot is usually enough, and try the code again.
What each browser can receive
The difference is not the connection. That is the same everywhere. It is what the browser can do with the bytes as they arrive.
| Browser | Where a received file goes | Practical limit |
|---|---|---|
| Chrome, Edge (desktop) | Written to disk as it arrives | None, free space |
| Firefox, Safari | Held in memory until complete | A few hundred MB, and the tab's own headroom |
| Chrome, Safari (mobile) | Held in memory until complete | Smaller again; phones reclaim memory sooner |
| Any browser, sending | Read off disk 16KB at a time | None, the sending side never holds the file |
Which is why a file over 25MB asks before it starts, and one over 256MB asks where to put it first. Sending is unrestricted everywhere; only receiving depends on the browser.
How to send a file from one device to another
Open this page on the device holding the file and press Get a code. Open the same page on the other device, or scan the square, and type the six characters. The two browsers find each other, the safety code appears on both screens, and from then on anything either side sends goes straight across. It works in both directions at once; there is no sender and no receiver, only two devices in the same room.
What actually reaches a server, and what does not
One thing does: the introduction. Two browsers cannot find each other unaided, so each describes how it can be reached, a few hundred bytes of network detail, and a small Worker copies that description to the other. The room holds two connections, copies one message to the other, and is destroyed when you both leave or after ten minutes, whichever comes first.
The file is not in that description and never passes through the room. It goes between the two machines over a connection encrypted end to end by the browsers themselves; we could not read it if the code were written to try. Nothing is stored, which also means there is nowhere for a file to wait: both devices have to be open at the same time. If that does not suit, the other shape of transfer is the one you want; see the end of this page.
Why it works when the same-network tools do not
AirDrop, Quick Share and the rest need both devices on the same network, and often on the same make of hardware. This does not: the two browsers negotiate a route through whatever is between them, so a laptop on home Wi-Fi and a phone on mobile data can send to each other directly.
A public STUN server helps with the part neither browser can work out alone: what its own address looks like from outside its router. It sees an IP address and nothing else: no file, no name, no metadata. Some corporate and hotel networks block direct connections between machines entirely; on those, this page will say so rather than spin.
The safety code, and why nothing else shows you one
The six-character code proves you both typed the same thing. It does not prove you are connected to each other: anyone who read it over your shoulder, or reached the room first, would see exactly the same page you do.
What cannot be faked is the encryption key each browser generates for this one connection. The four digits under Safety code are derived from both keys, so they can only match if the channel runs between the two devices in front of you. Read them aloud. If they agree, you are talking to each other. If they do not, something is in between, and you can see that without knowing anything about the cryptography underneath.
Size, and the difference between browsers
Sending has no limit anywhere: the file is read off disk 16KB at a time and never held whole. Receiving is where browsers differ. Chrome and Edge can open a file on disk and write to it as the chunks land, so the file never occupies memory and its size stops mattering. Firefox and Safari have no such interface, and hold everything until the last chunk arrives, which works well for a photograph and ends the tab for a video.
So the page asks. Under 25MB it says nothing. Between 25MB and 256MB it asks whether to accept, because on some browsers that is your memory being spent. Above 256MB it asks where to save first, because choosing the place is what makes the transfer possible at all, and on a browser that cannot do it, the page says so instead of failing halfway through a twenty-minute transfer.
When you want the other kind of transfer
This one needs both devices open at once, because nothing is stored. The other shape : upload once, get a link, the other person collects it whenever they like, answers a different question, and there are times only it will do: sending to someone asleep in another time zone, or to an address rather than a person.
Neither replaces the other. Use this one when both devices are in your hands or both people are at their desks; use a link-and-expiry service when they are not.
Questions
Is my file uploaded anywhere?
No. The only thing that passes through a server is the connection description: a few hundred bytes saying how each browser can be reached. The file goes directly between the two devices and is never written to any server, ours or anyone's.
How big a file can I send?
Sending has no limit. Receiving depends on the browser: Chrome and Edge write to disk as the file arrives and have no practical ceiling, while Firefox and Safari hold it in memory until it is complete. See the table above.
Do both devices have to be on the same Wi-Fi?
No, and that is the main difference from AirDrop and Quick Share. The two browsers negotiate a route between whatever networks they are on.
What is the four-digit safety code?
Four digits derived from the encryption keys the two browsers generated for this connection. They can only match if the channel runs between your two devices, so reading them aloud confirms who you are connected to.
Can we both send at once?
Yes. Once connected there is no sender and no receiver: either side can send files or messages, in either direction, at any time.
Do I have to save a photo to look at it?
No. Photographs, video and audio play in the page as they arrive. Save the ones you want and remove the rest; nothing is kept when you close the tab.
How long does a code last?
Ten minutes, and it introduces one pair of devices. After that the room is gone and the code means nothing, get a new one. A transfer already in progress is not affected, because by then the room is no longer involved in it.
What happens if I close the tab?
The connection ends immediately and anything in flight stops. Nothing is stored anywhere to resume from, which is the same property that keeps the file private.
Is the transfer encrypted?
Yes. WebRTC data channels are encrypted with DTLS by the browsers themselves, and it cannot be turned off. The safety code is derived from the keys involved.
Why did it fail to connect?
Some networks block direct connections between machines outright: corporate Wi-Fi and hotel networks are the usual culprits. Trying one device on mobile data is the quickest test.