send text, files, directories, raw streams, and SSH invites
one session / one token / no inbound port
move a file without opening a port
derphole is a small CLI for sending files, piping bytes, and sharing localhost services between machines that may both be behind NAT. It uses a one-session token and a relay rendezvous path, then moves to direct transport when the network allows.
cli first
native path, fastest path
npx -y derphole@latest send ./file
npx -y derphole@latest receive <code>share a localhost service without exposing it to the Internet
rendezvous through a relay, then switch the live session to direct
DERP, in plain terms
DERP stands for Designated Encrypted Relay for Packets. It gives both peers a reachable meeting point when they cannot reach each other directly yet. derphole uses Tailscale's open-source DERP implementation plus the public DERP map and relays for rendezvous and encrypted fallback. derphole is not affiliated with Tailscale, does not use tailscaled, and does not require a Tailscale account or tailnet.
not a VPN
There is no long-lived mesh, subnet route, ACL system, or network interface. A token authorizes one transfer or one shared service. Copy the token to the other side over a channel you trust.
browser proof
same session shape, browser limits
The browser demo is a proof, not the fast path. It starts over DERP relay, tries WebRTC direct, and keeps the sender/receiver flow visible without installing the CLI.
send
offer a file
Select one file. Send the generated token to the receiver.
No file selected.
idle
idle
recv
claim the token
Paste the token, pick a save location, and receive the file.
idle
idle
use the CLI for real transfers
npx -y derphole@latest listen > disk.img
cat ./disk.img | npx -y derphole@latest pipe <token>
npx -y derphole@latest share 127.0.0.1:3000
npx -y derphole@latest open <token>fine print on the web demo
Browser JavaScript cannot open raw UDP sockets, so this page uses DERP-over-WebSocket and WebRTC DataChannel. Relay frames are capped at 16 KiB and ACKed to protect browser memory and public DERP queues. Use the native CLI for large files and throughput work.