open source access tools for awkward networks

private access without a vpn

Move a file, open a TCP tunnel, or share a terminal when both machines can dial out but neither one should become public infrastructure. It is one capability, not a whole new network.

github repo run with npx

derphole

move a file

One token, one short-lived session: files, streams, receive codes, and localhost shares without a permanent network to clean up later.

npx -y derphole@latest receive <code>

derptun

open a tcp tunnel

When a service needs to survive reconnects, use scoped server and client tokens instead of a copy-pasted one-hour share.

npx -y derptun@latest token server > server.dts
npx -y derptun@latest serve --token-file server.dts --tcp 127.0.0.1:3000

derpssh

share your terminal

Share one PTY after host approval. No inbound SSH port, no tailnet, no surprise machine on someone else's network.

npx -y derpssh@latest connect <invite>

not a vpn

scoped access, not a network

A VPN is right when you want a network. These tools are for one transfer, one tunnel, or one terminal session. Tokens authorize the capability; no daemon, overlay interface, subnet route, or account control plane follows you home.

derp explained

relay first, direct when possible

DERP gives both sides somewhere to meet when inbound ports are blocked. It can relay encrypted traffic when direct paths fail, and the session moves to direct encrypted UDP when the network allows it. Relays are useful. They do not get payload keys. This project is not affiliated with Tailscale.

run with npx

use the native tools first

npx -y derphole@latest send ./file
npx -y derptun@latest token server > server.dts
npx -y derptun@latest serve --token-file server.dts --tcp 127.0.0.1:3000
npx -y derpssh@latest share

one transport family

small tools, shared path

Same transport family, different lifetime. derphole is temporary. derptun is durable. derpssh is interactive. The point is to pick the smallest amount of network state that does the job.

browser demo

try a small derphole transfer

This is the browser-sized version of the flow. It is useful for seeing tokens and claims work without installing anything. Use the CLI for real files, terminal sharing, and throughput work.

send

offer a file

Pick one file. The generated token is the access capability.

No file selected.

token

idle

idle

recv

claim the token

Paste the token, choose where the file goes, and receive it.

token

idle

idle