WHAT THIS PROTECTS
- Files travel directly peer-to-peer over an encrypted (DTLS) WebRTC channel — they are never uploaded to or stored on any server.
- No account, no sign-up. Fully open source (GPL-3.0), so the code can be audited.
WHAT THIS DOES NOT PROTECT
- Your IP address. WebRTC needs it to make the connection, so every peer in the room — including whoever invited you — sees it. A hostile host can log “this IP received this file at this time.”
- Metadata. The public signaling relays see connection timing, the room name’s fingerprint, and your IP when your browser reaches them.
- Code integrity. Whoever serves this page controls the code your browser runs. All code — including the Trystero library — is vendored into this one file, so there is no CDN in the trust path: download the file and open it locally (
file://) and no remote party is involved at all.
- Access. The room name is the only secret; anyone who has it can join and receive. Peers are not authenticated.
⚠ If you are a source, journalist, activist, or otherwise at physical or legal risk: do not use this.
Use tools designed for that threat model, which hide both parties’ IPs over Tor —
OnionShare or
SecureDrop.
Think of DEADDROP like AirDrop: convenient, cloud-free sharing between people who already know and trust each other and don’t mind revealing their IP to one another.