KeibiDrop

• A big file opens right away, because only the parts you read cross the network, and your edits save back.
• No cloud stores your files, and the relay that connects you cannot read them, because they are end-to-end encrypted with protection against future quantum computers.
• On the same network you connect with one click. Over the internet you swap a code once and then save the contact.
• With Teleport on, your friend's files are a real folder on your computer, so any app works with them, git clone included.
• It runs on macOS, Linux, Windows and Android, and iOS is on the way. The code is open source under the AGPL-3.0.

Get it: Mac · Windows · Linux · Android · every click, per computer · or try it on the web

Jump to: Install · Quick start · Direct transfer and Teleport · NAS · Encryption · By trade · Troubleshooting

Getting started: install it on both computers and connect once. On the same Wi-Fi, turn on Local mode; anywhere else, send your code in any chat and paste your friend's code. Then drop a file in, or open their files with Teleport. Each step has a short clip, and the clips are also a YouTube playlist. To open the files on a NAS or a home server, see Run it on a NAS.

Install

macOS

brew tap keibisoft/keibidrop
brew trust keibisoft/keibidrop
brew install keibidrop

Linux (Debian/Ubuntu)

wget -O keibidrop.deb $(curl -s https://api.github.com/repos/KeibiSoft/KeibiDrop/releases/latest \
  | grep -o 'https://[^"]*_amd64\.deb')
sudo apt install ./keibidrop.deb

Windows

choco install keibidrop

Or download from GitHub Releases.

Android

We host our own F-Droid repository. Open fdroid.keibisoft.com on your phone, scan the code, and check the fingerprint before you add it.

To add it by hand, use https://fdroid.keibisoft.com/fdroid/repo in F-Droid under Settings, Repositories. The fingerprint to check is on the same page.

NAS or home server

On Unraid, open the Apps tab and search for KeibiDrop in Community Applications. On Synology Container Manager, QNAP Container Station or any other Docker host, use keibisoft/keibidrop from Docker Hub, or ghcr.io/keibisoft/keibidrop. The setup is in Run it on a NAS.

Build from source

git clone https://github.com/KeibiSoft/KeibiDrop.git
cd KeibiDrop
make build-kd       # CLI daemon
make build-cli      # Interactive CLI
make build-rust     # Desktop UI (needs Rust + Slint)

Quick start

On the same network:

1. You and your friend both open KeibiDrop and turn on Local mode.
2. Your computers find each other.
3. Click your friend's computer to connect.
4. Share files.

Over the internet:

1. You and your friend both open KeibiDrop.
2. Copy your code and send it to your friend in any chat.
3. Paste each other's codes and both press Connect.
4. Share files.

Save your friend as a contact to skip the code exchange next time.

KeibiDrop works through firewalls. When a direct connection fails, it uses an encrypted relay, so you need no port forwarding and no router setup.

Direct transfer and Teleport

With direct transfer you add files and your friend saves the ones they need. It needs nothing extra and suits sending large files.

With Teleport your friend's files appear as a folder on your computer, which suits working on shared files and git repositories. It needs a driver installed once: macFUSE on a Mac, fuse3 on Linux or WinFsp on Windows.

Run it on a NAS

A NAS or a home server stays online, so it can serve a folder to your computer all the time. The box runs the KeibiDrop container. Your computer opens the box's folder with Teleport, from anywhere, and reads only what it opens.

1. On your computer, install KeibiDrop and the Teleport driver. Open the app, keep Local mode off and press Copy my code.
2. On the box, save docker-compose.yml, set the folder to share and paste your computer's code into KD_PEER.
3. Run docker compose up -d, then docker compose logs -f. The log prints the box's code.
4. On your computer, turn on Teleport, paste the box's code and press Connect.
5. Press Save contact and turn on Auto on the contact's row. From then on both sides reconnect by themselves.
6. The box's files now show in your Teleport Folder, ~/KeibiDrop/Mount by default. Open the files from there in any app. For DaVinci Resolve, follow the Resolve setup.

The image is on Docker Hub as keibisoft/keibidrop and on GHCR as ghcr.io/keibisoft/keibidrop, for amd64 and arm64, and Unraid installs it from Community Applications. The container's settings and the limits are in docker/README.md, and the full guide is Run KeibiDrop on a NAS.

Connection and encryption

1. The two computers exchange codes, or find each other on the local network.
2. KeibiDrop picks the fastest path: the local network, a direct connection or the encrypted relay.
3. Files cross an encrypted channel that the relay cannot read.
4. Keys rotate during the session for forward secrecy.

The encryption is post-quantum (ML-KEM-1024 + X25519) with AES-256-GCM or ChaCha20-Poly1305. Full protocol details in Security.md.

Desktop UI (Rust/Slint)

./keibidrop

Interactive CLI (terminal REPL)

./keibidrop-cli

Agent CLI (for scripts and AI agents, all output is JSON)

./kd start                           # Start daemon
./kd show fingerprint                # Get your fingerprint
./kd register <peer-fingerprint>     # Register peer
./kd create                          # Create room (or: kd join)
./kd add /path/to/file.zip           # Share a file
./kd list                            # List shared files
./kd pull file.zip ~/Downloads/      # Download a file

See docs/kd-agent-guide.md.

KeibiDrop reads ~/.config/keibidrop/config.toml. Environment variables override the config.

Post-quantum hybrid key exchange prevents future quantum computers from decrypting recorded traffic. Forward secrecy via periodic re-keying limits exposure if a session key is ever compromised.

By default, identity persists across sessions (so saved contacts keep working), encrypted with a per-install master key stored in the OS keychain (macOS Keychain Services, Linux Secret Service, Windows Credential Manager). Headless setups fall back to ~/.config/keibidrop/.master.key (mode 0600). A passphrase (Argon2id) can protect it for users who back up the config to a cloud. Incognito mode uses a new key pair for each session and writes nothing to disk, so two sessions cannot be linked.

Full protocol description: Security.md

Troubleshooting

See TROUBLESHOOTING.md.

Contributing

See CONTRIBUTING.md.

License

From version 0.5.0 the engine, CLI, mobile bindings and desktop UI are licensed under the GNU Affero General Public License v3.0 (AGPL-3.0-only). A closed-source product that embeds or links them needs a commercial license.

Mobile apps and brand assets: Proprietary - see LICENSING.md

Desktop UI built with Slint

Built by KeibiSoft SRL.

By trade

Remote DFIR triage

Mount an evidence share read only across NAT and extract the artifact set you need, with no inbound port, native on Windows, and no kernel driver on the evidence machine. There is a write-up and a DFIR page.

Post-production handoff

Mount the camera originals and skip the proxy transcode before the handoff and the relink after it. The Resolve setup goes step by step.

Datasets on a rented GPU box

Mount the workstation that holds the data, with no bucket and no upload before the first batch.

An always-on box, such as a NAS

A session needs both machines online, and a NAS or a home server stays online all the time. The container in docker/ runs the serving side on that box from plain Docker with the stock kernel. Your laptop mounts the folder from anywhere and reads on demand, so only the bytes a program reads cross the wire. In that run the box, a container on a server in Timisoara, served 161 files to a laptop in Bucharest; after it paired once, the laptop listed the folder and hashed one photo. The setup steps are in Run it on a NAS.

Photographers and editors

The raws and the footage stay on the box at the studio. The laptop mounts the folder, Lightroom or Resolve opens the files from the mount, and each file moves only when it is opened; a 1 MiB read out of a big file moves one 16 MiB block. The catalog stays on the laptop, as the post-production page and the video and audio guide describe. Set the share read only when the box is the archive and the laptop must change nothing.

Agents, and the data they work on

Two agents, one per machine, each drive a KeibiDrop peer through the MCP server. The laptop offers a folder where it sits, and the gpu box mounts it and checksums 24 shards out of 2,184 files six folders deep. In that run 88,581 bytes crossed the network out of 6,784,286 on disk, because that is what it opened. The whole thing, pairing included, took 12.5 seconds.

Build it with make build-kdmcp, then kdmcp install prints the config snippet for your MCP client. Sending stays off until KD_SHARE_ROOT names one directory to send from, so a receiving agent cannot be talked into shipping files out.

Links

• Website
• Documentation
• Compared with sshfs - measured on a 200 ms link
• Compared with other tools, such as LucidLink, Syncthing, Resilio Sync, rclone, WeTransfer, LocalSend, PairDrop and KDE Connect, one table each
• Technical deep dive
• Engineering blog
• FAQ
• Comparison with alternatives
• About and credentials