Wormhole
Decentralized P2P & IPFS Transfer E2EE ZEN Protocol
Drag & drop your file here, or browse
Share this secret key with the recipient. The transfer begins automatically as soon as the receiver enters the code.
The code serves as both the signaling rendezvous key and the 256-bit decryption key. No intermediary ever sees the plaintext.
Decentralized P2P & IPFS File Transfer
WORMHOLE enables wire-speed, end-to-end encrypted file sharing between peers using direct WebRTC DataChannels, serverless ZEN signaling, and decentralized IPFS staging fallback.
Direct P2P Stream (WebRTC) Default
Inspired by FilePizza, files are streamed directly between peers using binary RTCDataChannel in 64KB
chunks.
- ✓ Zero Base64 & Zero DB Flooding: Wire-speed transfer over UDP/SCTP.
-
✓
Flow Control: Native backpressure management (
bufferedAmount).
Serverless Signaling via ZEN GunDB
The ZEN distributed graph database acts as a decentralized rendezvous bus, eliminating reliance on proprietary WebSocket or Socket.io servers.
- ✓ Lightweight Handshake (~2-3 KB): SDP Offer/Answer & ICE candidates.
- ✓ Ephemeral Coordination: Rendezvous metadata cleaned up upon handshake.
IPFS Relay (delay) --ipfs
When peers are behind symmetric enterprise NATs or asynchronous delivery is required, encrypted files are staged on IPFS via the companion relay scobru/delay.
- ✓ Automatic Cache Purge: Receiver confirmation triggers automated unpinning.
- ✓ Custom Relay Support: Run your own self-hosted delay instance anytime.
End-to-End Encryption (E2EE) AES-GCM
All files are encrypted client-side using military-grade AES-GCM (256-bit) with PBKDF2 key derivation.
-
✓
Zero-Knowledge Mnemonic: The code (e.g.
82-gentle-bird) is both the address and the key. - ✓ Confidentiality: Relays and signaling nodes never see plaintext or filenames.
🔄 How Wormhole Works Under the Hood
Local Encryption
Sender generates mnemonic code and encrypts file via AES-256-GCM in the browser or terminal.
ZEN Discovery
Receiver inputs code. Peers discover each other over ZEN graph and exchange WebRTC SDP & ICE.
Direct Stream
Encrypted binary chunks travel at wire-speed through WebRTC DataChannel (or IPFS fallback).
Local Decryption
Receiver decrypts stream in memory and saves file. Signaling state & relay caches auto-purge.
Wormhole CLI (wh)
The CLI binary is named wh to prevent
collisions with magic-wormhole. Fast, lightweight, and sharing
the exact universal core with this browser dashboard.
Gives you direct access to the global wh command from any terminal shell.
Zero disk setup required. Runs on-demand anywhere Node.js is installed.
[+] Deriving AES-256-GCM encryption keys...
[+] Connected to ZEN rendezvous graph: https://delay.scobrudot.dev/zen
[✓] Peer connected via WebRTC DataChannel (Direct P2P)
[▶] Streaming chunks: [====================] 100% (52.3 MB/s)
[✓] Transfer complete! Decrypted and verified by recipient.
🛠️ CLI Command Reference
| Command | Description | Action |
|---|---|---|
| wh send <file> [options] | Encrypts and streams file via direct WebRTC P2P (or IPFS relay). | |
| wh receive <code> [options] | Connects to sender, downloads stream, and decrypts using sync code. | |
| wh list | Lists currently active transfers (experimental). |
⚙️ CLI Options & Flags
| Flag | Shorthand | Description | Default |
|---|---|---|---|
| --p2p | - | Use direct WebRTC DataChannel streaming. | true |
| --ipfs, --relay | - | Send via IPFS relay instead of direct P2P. | false |
| --url <url> | -u | Custom IPFS relay URL. | https://delay.scobrudot.dev |
| --token <token> | -t | Bearer auth token for IPFS relay upload. | mysecrettoken |
💡 Practical Usage Examples
Recommended for fastest direct transfer:
Ideal when sender and receiver are not online at same time: