# EasyTransfer moves files peer to peer behind a four digit code

> EasyTransfer is a Vue and WebRTC tool for transferring files directly between two devices with a four digit device code, no account and no server in the path, and it can be self hosted with your own STUN and TURN servers. It suits someone sending a file across networks, and its end-to-end guarantee has one documented exception for peers behind a NAT.

**DevXDojo/EasyTransfer** — A 🌟free, 🫣anonymous, 🔐encrypted, and 🚀easy-to-use E2EE file transfer tool

- Repository: https://github.com/DevXDojo/EasyTransfer
- Website: https://file.ch3nyang.top
- Stars: 691 · Forks: 108
- Language: TypeScript
- License: GPL-3.0
- Published: 2026-10-21 · Updated: 2026-10-21 · Language: en
- Canonical page: https://hysenlabs.com/projects/devxdojo-easytransfer

## The connection is a four digit code and nothing else

EasyTransfer is described as a free, anonymous, encrypted and easy to use end-to-end encrypted file transfer tool, and the connection model is what makes that claim plausible. You visit a simple web page to connect to any device in any network using a device code. The usage steps are four. Open EasyTransfer on both devices. Type the four digit device code of one into the other and click connect. Once the connection succeeds, drag and drop a file onto the file area or click it to select, and multiple files at once are supported. In the settings you can customise the STUN server and the TURN server, or set a maximum number of connections. The project is built on WebRTC and Vue.js, and it is published as a live site at file.ch3nyang.top with a Chinese and an English README. The anonymity claim is a specific one, that you need to register an account, log in or provide any personal information, and the file is transferred directly from sender to receiver without going through the server.

## Where the end-to-end claim has a footnote

The feature list is written as a set of short claims, and the end-to-end one carries a footnote marker that the reader should not skip. The footnote says that if the communicating peers need to penetrate the intranet, the file may be uploaded to the free TURN server provided by this project, and that you can avoid this by deploying a trusted TURN server yourself. That is the important technical detail in the whole README. A TURN server is a relay. When two peers cannot negotiate a direct path, one of them sends the traffic to the relay, and the relay forwards it, which means the file passes through infrastructure. In the default deployment, that infrastructure is operated by the project. The transfer is still encrypted in the sense that the relay cannot read the payload, but the end-to-end property in the sense of the server never holding the file at all does not hold. The footnote is not hidden and the fix is stated, deploy your own, but the decision is yours and it is a real one for any file you would not want sitting on a third party's disk.

## Why STUN and TURN configuration is a first class setting

The settings screen exposing the STUN server, the TURN server and the maximum number of connections tells you how much of the operational reality lives in the client. A WebRTC connection between two browsers needs a way to discover the other side's address, which is what STUN does, and it needs a fallback relay when that discovery fails or when a firewall blocks the direct path, which is what TURN does. The documentation recommends that you deploy a STUN and TURN server yourself to obtain faster speed and higher stability, which is a statement about the public defaults as much as about your own setup. The maximum number of connections setting is the third lever, and it is the one that protects the server you are running, since a relay will happily carry more traffic than you intended if you let it. The other thing to note is the custom settings line, that all modules can be customised and deployed by yourself, which is the project's answer to the relay question and to the general case of running infrastructure in a country where the public defaults are unreachable.

## What the tool does and does not cover

The feature set is compact and worth reading as a scope statement. Beyond the anonymity, encryption and end-to-end properties already covered, there is cross-network support, described as transfer between LAN and WAN, and easy to use, meaning devices are connected using a four digit device code without any extra operations. Multimedia messages covers sending text and various file types, and also supports sending photos, which is a slightly odd phrase that in practice means the app has specific handling for image content rather than treating it as a generic blob. The repository layout is consistent with a split between the browser client and the signalling and relay side, with a client/ directory, a server/ directory and a deploy/ directory, and the standard set of community files including a CODE_OF_CONDUCT.md, a SECURITY.md, a CHANGELOG.md and an AGENTS.md. The self deployment instructions are not in the README, they are in the project wiki, under a Navigator page, and the documentation points there rather than describing a docker compose file, which is where you should look if you intend to run it yourself.

## The four digit code is the weak point

A design that removes accounts, removes logins and removes the need to exchange public keys has to replace that trust with something, and here it is a four digit code. That is a small space. A code of four decimal digits is ten thousand possibilities, and a peer that is already on the same page has to guess or be told one. The consequence for the threat model is that authorisation rests on the secrecy of the code rather than on cryptography, which is a reasonable design for a tool whose whole premise is convenience, and a reasonable one to be aware of. The footnote about the relay compounds it, because in the fallback case a third party holds the file even if it cannot read it. There is a mitigating design choice, though, and it is the custom deployment option. If you deploy the whole thing, including the signalling server and the TURN server, then the device code only has to be secret between the two people using it, and the relay is one you control. That turns the tool from a convenience service into something with a defensible model, and it is the deployment mode the project keeps pointing at, so it is worth reading the wiki before you decide the hosted instance is good enough.

## Conclusion

Adopt EasyTransfer when you need to hand a large file to another device without an account, an upload step or a third party server in the path, and when you are willing to run your own STUN and TURN infrastructure. Do not adopt it on the assumption that the traffic never touches a server, because the documentation states that a file may be uploaded to the project's free TURN server when peers must penetrate an intranet. Verify first whether your two devices can establish a direct path, that you have a TURN server you trust for the cases where they cannot, and that the device code exchange is safe in your setting, since four digits is a very small space.

## FAQ

### How do I use EasyTransfer to send a file?

Open the EasyTransfer web page on both devices, type the four digit device code of one into the other and click connect, then drag and drop files onto the file area or click to select them. Multiple files at once are supported, and the settings let you customise the STUN server, the TURN server and the maximum number of connections.

### Does EasyTransfer ever send my file through a server?

In the normal case the file goes directly from sender to receiver. The README footnotes that if the communicating peers need to penetrate the intranet, the file may be uploaded to the free TURN server provided by the project, and that deploying a trusted TURN server yourself avoids this.

### What is EasyTransfer built with?

WebRTC and Vue.js, with the repository split into a client/ directory, a server/ directory and a deploy/ directory. The live instance is at file.ch3nyang.top, and the project is MIT licensed with GPL-3.0 listed as the licence identifier in the repository facts.

### Can I self host EasyTransfer?

Yes. The project states that all modules can be customised and deployed by yourself, and the self deployment methods are documented in the project wiki under a Navigator page rather than in the README. The recommendation in the documentation is to run your own STUN and TURN server for faster speed and higher stability.

## Sources

- [DevXDojo/EasyTransfer on GitHub](https://github.com/DevXDojo/EasyTransfer)
- [Issues](https://github.com/DevXDojo/EasyTransfer/issues)
- [License: GPL-3.0](https://github.com/DevXDojo/EasyTransfer/blob/main/LICENSE)
- [Project website](https://file.ch3nyang.top)
- [README](https://github.com/DevXDojo/EasyTransfer/blob/main/README.md)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/devxdojo-easytransfer