DashBeam: end-to-end encrypted file transfer built on iroh, from LAN to roaming

Dialing a device key instead of an IP address

DashBeam's foundation is iroh, the peer-to-peer networking stack from iroh.computer, and that choice shapes everything the app can do. Connections are made by device identity rather than IP address, which is what enables the roaming feature: a transfer can switch between Wi-Fi, cellular and other networks mid-stream without dropping, because the endpoint is a stable key rather than an address that goes stale. Transfers are encrypted end to end with TLS 1.3 and authenticated through tickets, the access tokens a sender hands a receiver. File integrity is verified with BLAKE3, so a completed multi-hundred-gigabyte transfer carries a cryptographic check rather than a hopeful comparison of sizes. There are no accounts, no tracking and no ads in the README's description, and nothing is stored on cloud servers because the bytes go device to device. For anyone whose alternative is uploading to a file host first, that is the whole thesis in one sentence.

Three routes to a receiver, none requiring their install

The delivery model offers three routes that the README says move the same bytes the same way. A link or QR code opens on any device, including a plain browser at no install cost. A paired device, established once via a code that works remotely or through the Nearby flow, can be sent to thereafter without tickets. And a device already on your network can be discovered automatically, since LAN auto-discovery surfaces same-network apps under Nearby in Settings then Devices, with a Pair & Send action that pairs and starts a transfer in one step. The first-contact flow shows a verification code on both screens, a sensible check that the device answering is the one intended, and visibility controls exist for who can discover you. The design assumes the common real-world case: a technically willing sender and a receiver who should not be asked to install anything, and it handles that case through the browser route at app.dashbeam.net, with the caveat, noted in the install table itself, that the web client has limited throughput.

Trusted devices: the auto-accept convenience and its cost

Version 0.7.1, released 2026-09-01, introduces trusted devices: a paired device can be opted into auto-accept, after which files it sends arrive without a prompt. This is the feature most worth thinking about rather than just enabling. Auto-accept moves the security boundary from each transfer to the pairing moment; once a device is trusted, anyone holding that unlocked device, or any malware running on it, can push files onto your machine unchallenged. The mitigation is that trust is explicit, scoped per paired device, and presumably revocable in the same settings panel, though the supplied material does not document revocation steps. The same calculus applies to the nearby discovery surface: making yourself findable on a LAN is a convenience that deserves a default-off posture on hostile networks. None of this is a flaw; it is the standard trade-off every accept-prompt system faces when it adds automation, and the verification codes on first contact show the project taking the pairing step seriously.

The performance table is self-reported, and says so

The README presents a stats table under the honest heading Real-world stats, with a column literally named Reported: a largest transfer of 452 GB, a fastest large transfer of 54 GB at 123 MB/s, a bulk move of 328 GB at 93 MB/s, and a peak measured speed of 125 MB/s, which the table itself annotates as about 1 Gbps. A disclaimer follows, stating that throughput depends on device, network and connection path. Treating these as community anecdotes rather than benchmarks is the right reading, and the project deserves credit for labelling them that way instead of dressing them up as test results. What the numbers do establish is intent: DashBeam is engineered for very large files and for saturating fast links, and the resumable transfer feature exists precisely because 452 GB moves are where interruptions happen. The CLI build, at roughly 4 to 5 MB, and desktop installs around 10 to 15 MB, support the same story of a tool that stays out of the way.

Every platform except iOS, small footprints, one web caveat

Coverage is broad: Windows installers, MSI and portable ZIP, macOS universal plus Apple Silicon and Intel disk images, Linux deb, rpm and AppImage, Android APKs for arm64, armv7 and universal, a CLI, and the web client. The README is translated into eleven languages and the supported-languages list for the interface covers roughly two dozen, which is unusual thoroughness for a small project. Install sizes are modest across the board, roughly 10 MB on Windows, 15 MB on macOS, 13 MB on Linux, 50 MB on Android, 2 MB for the web build. The notable gap is iOS, absent from every table in the material, so an iPhone can at best act as a receiver through the browser route. Troubleshooting lives in docs/troubleshooting.md, including how to collect logs, and an opt-in advanced debug mode exists for diagnostics, which the README frames as transparency under the hood. A sponsors section lists one partner and invites more, and a Discord server handles support, consistent with a solo-maintainer project with a growing audience.

AGPL-3.0, relay economics, and where LocalSend fits

The licence is AGPL-3.0, strong copyleft: adapting the code into your own network service triggers source-disclosure obligations for the derivative, which matters to any company contemplating embedding transfer into a product. Maintenance is currently healthy: releases on 2026-08-02, 2026-08-21 and 2026-09-01, with the last push on 2026-09-01, ten days before this review's reference date. The infrastructure question deserves more attention than the README gives it. Remote transfers, meaning ones that cannot go direct over a LAN, depend on relays, and the self-host relay feature under Settings then Infra is described as delivering unthrottled remote transfers through your own relay, phrasing that implies the default shared relays are capacity-limited in some way the material does not specify. The closest open-source comparison is LocalSend, which handles same-network transfers well but stops at the LAN boundary, offering no relay-assisted remote path, no roaming between networks, and no device-key dialing. Cloud senders like WeTransfer or Dropbox solve distance by storing your files on their servers, the exact model DashBeam exists to avoid, and magic-wormhole pioneered the one-time-code approach from the command line. DashBeam's specific combination, iroh transport plus no-install receivers plus resumable multi-peer transfers, is what separates it from each of those.

Editorial conclusion

People who regularly move large files between their own machines, or to receivers who will not install anything, should download the v0.7.1 build for their platform, pair two devices, and reproduce a transfer over their own network before trusting the headline speeds. It is the wrong tool for organisations needing managed file transfer with audit trails and policy enforcement, or for users unwilling to depend on relay infrastructure for remote transfers. Verify three things first: who operates and throttles the default relays versus the self-hosted option under Settings then Infra, whether trusted-device auto-accept fits the physical security of your hardware, and that AGPL-3.0 is acceptable to your licensing posture before borrowing any of its code.

Official sources

1. License: AGPL-3.0
2. Project website
3. README
4. Releases
5. tonyantony300/dashbeam on GitHub