v2.1.1 desktop · v1.0.0 android
Your files never
leave the room.
Localynk pairs two devices on the same network with a QR scan, issues a client certificate, and moves files over TLS 1.3 — no cloud relay, no account, no data leaving the LAN.
Three steps, once per device.
Pairing happens exactly once per device pair. After that, every reconnection is authenticated with the certificate issued here — no password to re-enter, no code to re-scan.
Generate & scan
The host opens Pair a device and shows a one-time QR code and 6-digit fallback, valid for 180 seconds. The client scans it or types the code.
Verify fingerprint
The client checks the host's TLS certificate fingerprint against the value embedded in the QR payload before anything else happens — pinning the host identity.
Issue certificate
The client sends a CSR with the one-time token. The host signs it, stores the device in its SQLite trust registry, and future sessions use mTLS.
Built like infrastructure, not a file-drop widget.
Every transfer is sandboxed, authenticated, and logged. Localynk assumes a hostile LAN and defends accordingly.
Sandboxed filesystem
Every path resolves inside the shared root. Traversal and symlink escapes are rejected before the filesystem call runs.
mTLS trusted devices
Reconnections require a client certificate issued at pairing time, checked against a revocable SQLite registry — not a shared password.
Connection guard
Caps total and per-IP concurrent connections, then escalates temporary bans — 5 min → 20 min → 80 min — on repeated auth failures.
Scoped firewall rules
Opens exactly the active port via netsh or ufw, scoped to Private/Domain profiles, and removes it on exit.
Persistent audit log
Every list, upload, download, rename and delete is recorded by device, IP, path and result — survives restarts, exportable to CSV.
LAN discovery
mDNS finds Localynk hosts on the network automatically — pairing itself never depends on discovery working.
The dashboard, unmodified.
Native Tkinter/ttk on Windows and Linux — no Electron, no bundled browser runtime.
localynk — Home
Home — sharing status, access mode, quick actions.
localynk — Pair a device
Pairing — QR code, 6-digit fallback, live expiry.
Read it like a spec, because it is one.
No part of this is marketing copy — it's the actual configuration Localynk ships with.
- transportTLS restricted to 1.3 only — no fallback to earlier protocol versions.
- auth.pairingAuthorized by possession of a short-lived, one-time QR token (180s default).
- auth.fingerprintHost certificate fingerprint is pinned before the client submits its CSR.
- auth.sessionTrusted-device connections require a signed client certificate, checked against SQLite revocation state.
- fs.sandboxPaths cannot escape the shared root; symlinks are rejected in the V1 sandbox.
- fs.writesUploads land in a temp file and are atomically committed only after SHA-256 verification.
- net.bindServer binds to the detected LAN address, never
0.0.0.0. - net.firewallOpens the single active port on start, tagged Localynk for clean removal on stop.
- net.ratelimitGlobal + per-IP concurrency caps; escalating bans on repeated failures within a 60s window.
Pick your platform.
Desktop builds are source packages with per-OS install/compile scripts — you run the build on your own machine, so there's no third-party binary to trust.
Ships install.bat → setup.bat → run.bat, plus compile.bat to produce a standalone Localynk.exe via Nuitka.
Ships install.sh → setup.sh → run.sh, plus install-desktop.sh for an app-menu entry. Firewall via ufw/iptables.
Tkinter runs on macOS and a firewall helper stub exists, but there's no install/compile script or signed build yet. Untested — don't run it on a primary machine.
In progress Not availableJetpack Compose + Hilt client, min SDK 26 / target 35. No signed APK yet — open in Android Studio and build a debug APK, or run ./gradlew assembleDebug.