Create a capability
The source browser generates 256 random bits and uses HKDF-SHA-256 to derive separate values for file encryption, content discovery, and the host-led channel.
HOW IT WORKS
The file stays with browsers. The server coordinates the route.
this2.link separates access, encryption, signaling, and transfer. The complete link carries the capability; browsers process the content; infrastructure helps them meet and can temporarily forward ciphertext when direct WebRTC is blocked.
Try the transfer flowLocal encryption · WebRTC first · no server file store
THIS2LINK / CHANNEL
01BROWSER AENCRYPT LOCALLY
WEBRTC / CIPHERTEXT
02BROWSER BVERIFY + RESTORE
NO SERVER FILE COPY
PROCESS
From file to verified receive
Encrypt on the device
AES-256-GCM protects the manifest and chunked file content. Authentication binds protocol version, transfer ID, chunk index, and plaintext length.
Find an online source
A Durable Object coordinates room membership and SDP/ICE. It sees derived room credentials, not the complete capability, filename, or plaintext file bytes.
Transfer and hand off
WebRTC carries encrypted chunks directly when possible. A verified receiver can cache ciphertext and temporarily provide it to the next browser.
DIRECT PATH
WebRTC connects browsers when the network permits
The source and receiver negotiate a peer connection and open a DataChannel. File chunks are already encrypted at the application layer, so transport security is not the only protection around the content.
No TURN service or centralized upload bucket is used. That keeps the architecture small, but means some strict networks cannot establish the preferred direct route.
FALLBACK PATH
Only ciphertext can use the temporary relay
If direct connection attempts time out, the receiver can authorize a specific online source to send bounded encrypted frames through the existing WebSocket room. The Worker forwards frames and acknowledgements without assembling or persisting a file.
Relay limits are enforced per session and per source. If the free infrastructure quota or protocol limit is reached, the transfer fails instead of silently creating paid storage.
LOCAL-FIRST
The browser owns processing and temporary state
Compression support is detected at runtime. Encryption, decryption, integrity verification, and output creation happen on user devices. IndexedDB may hold authenticated ciphertext so a completed receiver can answer the channel temporarily.
Browser storage is best-effort and can be evicted. It is a cache, not a permanent pin, and the page must remain active to act as a source.
BOUNDARIES
The claims, stated precisely
No server-side file storage
The application has no upload API, file database, or R2 bucket. Restricted networks may still send encrypted frames through the relay.
End-to-end content encryption
The complete link is a bearer capability. Keep it private; anyone with it can decrypt while a source is available.
Availability follows browsers
The sender or a completed receiver must remain online. The last source leaving ends the availability guarantee.
FAQ
Technical FAQ
Why is the capability stored in the URL Fragment?
Browsers keep the Fragment client-side during normal HTTP navigation. This lets the app derive keys without placing the complete capability in the page request.
What does Cloudflare receive?
The Worker serves static assets, coordinates derived room identities and WebRTC signaling, and may temporarily forward bounded ciphertext frames. It does not receive the complete capability or plaintext metadata.
How is file corruption detected?
AES-GCM authenticates each indexed chunk with associated protocol data. The receiving browser rejects missing, reordered, length-mismatched, or unauthenticated content.
Why is the file limit 150 MB?
The current preview applies the same 150 MB boundary in the browser and relay protocol to keep memory, time, and free infrastructure usage predictable.
Is this a replacement for backups?
No. this2.link is an active transfer and temporary handoff tool. Important files should be saved in durable storage chosen by the recipient.
A local-first transfer path with explicit limits.
Try the transfer flow