Transfer over your own network

Nothing here touches the service. One machine listens, the other connects, and the bytes go straight across. It works with no account, on any plan, and with no internet connection at all.

Receive

s2u --receive                  # print this machine's address and wait for one transfer
s2u --receive --keep           # stay open for many, Ctrl-C to stop
s2u --receive --no-password    # open mode: prompts you to accept each transfer

Add --yes to open mode to accept without asking, which is convenient and is also exactly the protection you are removing.

Send

s2u photos.zip --dest 192.168.1.5
s2u big.iso --dest 192.168.1.5 --resume    # pick an interrupted send back up

Transfers use TLS 1.3 with a password-authenticated handshake. Peers can be found by mDNS and saved as aliases or trusted peers.

Serve a folder to any browser

s2u ./folder --serve --qr
s2u ./folder --serve -p        # prompt for a password, then require it

–serve has no protection unless you give it one

Unlike --receive, where you approve each transfer, a served folder is an open HTTP file server. Anyone who can reach the address can browse and download everything under it.

-p requires a password, and the bare flag prompts so it never lands in your shell history. It is plain HTTP, so the password and the files both travel in the clear. It controls access, not confidentiality.

Choosing which network to listen on

By default the receiver, the broadcaster and --serve listen on every interface, so a peer can reach you on whichever one it resolves. --bind narrows that to a single address:

s2u --receive --bind 192.168.1.5        # this LAN only
s2u ./folder --serve --bind 100.x.y.z   # tailnet only, not the local Wi-Fi

This matters most for --serve. On a machine that is also on a VPN or a guest network, the address it listens on is the only thing limiting who can reach it, and --bind is how you keep it off the networks you did not mean to serve.

Sending to a device you found by name

Discovery is unauthenticated. Any machine on the network can advertise any name. So when you send to a discovered device without a password, the receiver shows a short verify code and you are asked to confirm you see the same one.

Sending to an IP address, to a pasted pairing string, or with a password already identifies the receiver, and does not prompt.