instant.io transfers files peer to peer and tells you not to run it yourself

The install section says you probably should not

The installation section is split into two halves and the first one is a warning in the form of advice. If you only want to do file transfer on your own site, or to fetch and seed files over the protocol, there is no need to run a copy of this site on your own server, and the instruction is to use the underlying WebTorrent script directly. The reasoning is sound: the site is a demonstration of the library, and the library is the thing you would actually depend on. The readme also points at the exact file the browser side uses, so the part worth reading is a single client script rather than a repository. That is a smaller and more useful artefact than the project name suggests.

git clone https://github.com/webtorrent/instant.io
cd instant.io
npm install

Sharing is a URL fragment, not a link

The tips section explains how you actually use the thing, and it is two sentences long. To create a shareable link you append a torrent infohash or a magnet link to the end of the address, and the readme gives both forms, one with the fragment after the host and one with a slash before it, which is a distinction that matters for some clients and not for others. The second tip is that you can add multiple torrents in the same browser window. So the site is not a one-file-at-a-time utility but a tab that can hold several transfers at once, each identified by its fragment. There is no account, no upload form and no server-side storage anywhere in that description, which is the point of the underlying protocol.

A beta in the readme, version 1.0.0 in the manifest

The manifest and the readme disagree about how finished this is, and the disagreement is the most useful thing either document says. The readme calls it a beta in the same paragraph that describes the transfer, and the manifest records a first version number. The repository has no tagged releases at all, so there is no history to check and no way to see whether the number moved. The recorded last push is from the end of September 2026, so the code is being touched. Nothing in the documentation describes a compatibility guarantee for a site that runs entirely in a browser tab and depends on a peer connection library underneath, so the honest reading is that the version number is an artefact of the manifest rather than a maturity claim.

The relay credentials are synchronised to one account

Peer to peer connections inside a browser need a relay to help two peers find each other behind separate firewalls, and that relay has to be configured. The readme handles this by telling you to copy a sample file into place and point it at a relay server you consider valid. What it does not mention, and what the manifest shows, is that there are two scripts for synchronising that file, one downloading and one uploading, both using a recursive copy with a hard delete, and both naming the same personal account and a specific path inside it. That is a convenience for the maintainer rather than a deployment instruction, and anyone running a copy should treat the sample file as a template to replace rather than a setting to keep.

Two configuration files, in different directories

Running a copy is three steps and the configuration is deliberately split. One file at the repository root sets the address and port the server should listen on, and editing it is all that is needed to move the thing. The other lives in a directory named for secrets and holds the relay configuration, where the sample file has to be renamed before the server will use it. The rest of the tree explains how the thing is served rather than built: a web server configuration file and a process supervisor configuration at the root, a small tools directory with a deploy script, and a static directory that the build writes into. That last one matters if you read the build scripts, because the build output is not a separate branch or a published artefact, it is a directory the client bundle and the stylesheet are written into.

Eighteen exact runtime pins and one wildcard

The dependency list is worth scanning for two reasons. First, every runtime dependency is pinned to an exact version with no range operator, which for a service with a build step committed to a lockfile is a defensible choice and for a published library would be an unusual one. Second, eighteen of them is a lot for a page that does one thing, and reading the names explains why: a peer connection library, a torrent creation library, an HTTP server, a template engine, a zip library, a drag and drop library, an upload element shim, a logger, and a couple of small utilities for throttling and human-readable byte sizes. The development side is where the outlier is: the linter is the one dependency specified as a wildcard, everything else being exact.

Two build steps, three browsers, one console line

The build is two commands run in sequence. The stylesheet is compiled from a Stylus source into the static directory, and the client is bundled by Browserify into a single script in the same place, which is what makes the whole client shippable as one file over peer connections. Development uses file watching and a process restarter, and a size command reports the bundle weight for both the script and the stylesheet, which suggests someone watched it grow. As for what actually works, the readme names three browser families, a desktop one, a mobile one, and one more, and then gives a single debugging instruction: set a key in local storage from the console to a wildcard, then refresh, and the log output becomes detailed.

Editorial conclusion

instant.io suits someone who wants to understand how a browser torrent client is put together, since the whole client is small and readable. It does not suit someone who needs a production file-transfer service, since the readme calls it a beta and the deployment scripts are written against one maintainer's account. Before adopting any of it, read the client source rather than the site, and replace the sample relay credentials with your own rather than copying the sample file.

Frequently asked questions

Official sources

1. Issues
2. License: MIT
3. Project website
4. README
5. webtorrent/instant.io on GitHub