How two browsers meet with no server in the middle
There's a small confession hiding inside nearly every "peer-to-peer" tool you've used: the transfer is peer-to-peer, but the introduction is not. Before two devices can talk directly, somebody has to tell each one where the other lives — and that somebody is almost always a server on the internet. The industry calls it signaling. If the signaling server is down, blocked, or simply unreachable because your network has no internet today, the whole peer-to-peer marvel sits there unable to say hello.
We wanted the introduction to be as local as the transfer. So at this counter, the introduction is a piece of paper. Well — a QR code, which is the closest thing a screen has to paper.
What an introduction actually contains
Strip a WebRTC connection down to what genuinely can't be improvised, and it's a short list. Each browser needs to hand the other four things: a temporary username and password for the link-checking protocol (ICE, the part that probes which network paths actually work); a fingerprint of its encryption certificate, so the encrypted tunnel provably ends at the right device and not at an impostor; and one or more socket addresses — IP and port — where it's listening. Everything else in the multi-kilobyte "session description" browsers generate is boilerplate that both ends could have agreed on in advance.
So that's exactly what we do. Both devices load the same page, which means both carry the same rulebook. The sender's browser generates its session description, and instead of mailing the whole document anywhere, the page distills it to those unforgeable essentials — roughly 150 bytes — and prints them as a QR label on screen. The receiver's camera reads the label, and its copy of the rulebook rebuilds the full session description around those essentials, line by deterministic line. Then the receiver does the same thing in reverse with a reply label. Two scans, and both browsers hold a complete, mutually agreed contract. The connection opens.
The part that surprises people
Once you've seen it, the punchline is almost obvious: if the introduction travels by camera, the internet was never involved — so it can't be a point of failure. You can load this page on both devices, put the router in a drawer with its WAN cable dangling loose, and beam a video across the room at full wifi speed. Nothing complains, because nothing was talking to the outside world in the first place. The same trick holds on networks that never had internet: a bare travel router, a Raspberry Pi access point in a barn, the hotspot of a phone in airplane-mode-plus-wifi.
There's a privacy corollary too, and it's sturdier than a policy promise. A tool that pairs through a signaling server necessarily tells that server "these two devices are about to exchange something, at this time, from these addresses" — metadata, even when the file bytes flow directly. A label swapped by camera tells nobody anything. There is no log because there is no place a log could exist.
Fine print, kept honest
Two limits are worth stating plainly. First, the label swap assumes the two devices can already reach each other on the local network — that's what the wifi is for. Some networks (guest and hotel wifi, most often) deliberately forbid client-to-client traffic; we wrote up how to spot that separately, because it's the number-one support question in this whole category of tools. Second, if your devices are on genuinely different networks, purely local addresses aren't enough — for that case the counter has a clearly-marked switch that asks a public STUN server for each device's outside address. It's off by default, and flipping it is the one and only moment this tool touches a third-party machine: that server learns your IP, never your files.
None of this needed new technology. WebRTC has allowed manually-arranged connections since the beginning; nearly everyone just found a server more convenient than a camera. Fair enough — but the camera version has a property no server version can match: it works when the world outside your wifi doesn't. Come try it at the beaming counter, or read what actually rides inside the label.