PUFFLY.APP

Security

Send files directly between devices with Puffly. No accounts, no permanent file storage. Private encrypted peer-to-peer sharing with a link, QR or Puff Code.

Encryption in transit

WebRTC DataChannels use mandatory DTLS encryption. Puffly also encrypts file chunks with AES-GCM in the sending browser. A Puff Link carries a secret in its URL fragment, which is not sent with HTTP requests. For Puff Codes the sender shares the encryption key over the established encrypted WebRTC connection once WebRTC is established. A Puff Code is short, so share it only with someone you trust.

No persistent file storage

Puffly's servers keep temporary session identifiers, signaling data and operational statistics; never file contents. TURN may relay encrypted network packets if direct routing fails.

Keep transfers trusted

Only use Puffly with people you know and trust. Links can be forwarded by recipients. Do not open unfamiliar executables or suspicious files.