LightDrop / Security
Security
No network path is used for the transfer itself — but no network path does not mean secret. This page draws the boundary honestly.
What the design gives you
- No transit through third parties. The content never touches our server, a relay, or a cloud bucket. There is no server-side copy to breach later.
- No radio footprint. The transfer emits no Wi-Fi, Bluetooth or cellular traffic, which matters in environments where radios are restricted.
- Integrity, verified. SHA-256 verifies transfer integrity: the receiver only reports success when the rebuilt bytes hash to exactly what the sender computed. Note the verb — SHA-256 verifies; it does not encrypt.
- Nothing persisted. Payloads live in page memory only and vanish when you clear or close the page.
What it does not give you
- Confidentiality against onlookers. The QR stream is visible light. Any camera with line of sight to the sending screen — a person behind you, a CCTV camera, a phone across the room — can record and decode it. Treat a transfer like reading the content aloud in the room you're in.
- Encryption. The current version does not encrypt payloads. We deliberately have not shipped home-grown crypto; an unaudited cipher would create false confidence, which is worse than an honest limitation.
- Anonymity or untraceability. We make no such claims, and you should distrust any tool that does.
Practical guidance
- Do not transfer passwords, private keys, wallet recovery phrases, or other high-value credentials.
- Fine: links, notes, configs, tickets, documents you'd hand someone on paper.
- In shared spaces, angle the sending screen away from sightlines, and prefer short transfers.
Reporting a vulnerability
If you find a flaw in the decoder, the integrity check, or anything else, please open an issue on the source repository linked from the licenses page. We'd rather fix an embarrassing report than not receive it.