Encrypted chat and file sharing for small groups of people who actually trust each other. No account. No phone number. No server reading your messages. Works in your browser.
The anchor helps peers find each other. Your data never passes through it.
WASTE — the original — figured this out in 2003. Small trusted groups, encrypted, no central server. It got pulled within 24 hours of release, leaked back out, and slowly became a relic. The idea was right. The implementation didn't survive contact with NAT, modern browsers, or 20 years of better cryptography.
waste-go is the same idea rebuilt from scratch.
A small Go binary on any VPS. Its only job: help peers find each other by relaying sealed blobs. It never sees your network name, your messages, or your files.
WebRTC handles NAT traversal. Once two peers have exchanged signaling through the anchor, the connection is direct — DTLS-encrypted peer-to-peer. The anchor drops out of the picture.
Each peer has an Ed25519 keypair. You add someone's key to your keyring, they add yours. No username/password. No server to trust. Connections are verified cryptographically on both ends.
Generate an invite link. Send it over any channel. The recipient visits the URL — no install required, everything runs in the browser via WebAssembly. They're on the network in seconds.
Visit a URL. That's it. Crypto runs via libsodium compiled to WebAssembly — same primitives as the native client, same security guarantees. Identity persists in localStorage. Works on mobile. Can be pinned to your home screen as a PWA.
A Go process running locally. Full feature set: per-network identity isolation via HKDF, multi-share file libraries, transfer resume, terminal UI. Connects via JSON IPC — any UI can talk to it.
A Wails shell packaging the React frontend and daemon into a single native binary. Same codebase as the web UI — no Electron, just the OS webview. Windows, macOS, Linux.
YAW/2 — the protocol waste-go implements — was designed by a friend and formally specified before any code was written. The 2.0 baseline is locked for interop. Extensions are additive and backward-compatible.
The full case study covers the engineering decisions in depth — the identity binding problem, the NAT traversal tradeoffs, the forward-secrecy upgrade, and why the protocol spec came before the code.
Ephemeral, end-to-end encrypted file transfer between your own devices. Think AirDrop — without Apple.
Point-to-point file transfer between devices you own. No accounts, no upload limits, no files touching a server disk. Works across different networks — home WiFi to mobile data — via the same TURN relay as waste-go.
Sender generates a QR code. Receiver scans it. Both peers connect to the waste-go anchor, complete the YAW/2.1 handshake, open a WebRTC data channel, and the file transfers directly between devices. The anchor steps out after the handshake.
Install flit as a PWA and it registers as a Web Share Target. "Share → flit" appears in the OS share sheet alongside native apps — works from Photos, Files, Chrome downloads, anywhere.
For headless homelab boxes. flit send file.tar.gz renders a QR in the terminal using Unicode block characters — readable by a phone camera at normal screen distance.
flit daemon runs as a persistent receiver on a home box — auto-accepts files from trusted peers and saves them to a configured directory. One goroutine per peer, exponential backoff reconnect. Configure once in ~/.flit/daemon.toml, run it in tmux or as a systemd unit, forget about it.
flit reuses the waste-go anchor — no new server, same crypto, same identity model.