No login requiredIs WebRTC safe for file transfer?
WebRTC data channels encrypt files as they travel between browsers. Before sending something private, also check who is receiving it, whether the application uses a relay, and where the received file will be stored. These details determine what protection you get in practice.
WebRTC data channels encrypt traffic between the connected endpoints using DTLS. That helps protect file content against someone observing network traffic. It does not establish who controls the other device, make the website trustworthy by itself, or protect a file after the recipient saves it. A browser session also relies on the integrity of the page and its scripts.
The WebRTC security architecture describes the security model, and the data-channel specification documents SCTP carried over DTLS for non-media data. The website handles the rest: finding the recipient, asking for permission, reporting whether the file arrived and deciding what to store. Those choices vary between applications.
Direct transfer, TURN and MQTT are different routes
| Route in Textunnel | What the route means | What to check |
|---|---|---|
| Direct WebRTC | Encrypted data channel between the browsers | Confirm the intended peer and File channel ready |
| Optional TURN-assisted WebRTC | A TURN server carries encrypted WebRTC packets | Relay permission and a working configured service are required |
| MQTT fallback | Application content goes through an internet broker | Both tabs must allow relay; set a room password for payload encryption against the broker |
Online rooms use internet discovery and signaling even when file content takes a direct path. A DIRECT badge means a selected non-relay WebRTC route; it does not certify that all traffic stayed inside your Wi-Fi. A VPN can affect that route. For MQTT fallback, check the room password as well as relay permission: content passes through the broker, so this route needs its own payload protection.
Textunnel is designed primarily for same-Wi-Fi direct sharing. If you require an exchange without online signaling after loading the site, use the two-way Offline Connect QR workflow. The QR exchange carries connection information, not the file itself.
Who can see connection information?
Discovery and signaling services process connection metadata. Peers may learn network information needed to establish a connection. Browser mDNS masking can reduce exposure of local addresses, but it is not a promise of anonymity or a guarantee that public IP addresses remain hidden. TURN providers and other services also observe traffic metadata according to their role.
Share room details privately and confirm the receiving device before sending. For example, if you are moving a document from your phone to your laptop, check that the laptop appears in the device panel and is ready to receive. Use a strong room password when sharing sensitive text or permitting broker fallback. Anyone who can use the receiving device may still be able to read the saved document.
What remains after a transfer?
Textunnel keeps local history in the browser. Optional interrupted-file recovery temporarily stores eligible data, and saved downloads remain wherever you save them. Local history and recovery data are not encrypted at rest by Textunnel. Closing a tab is not a guarantee of immediate secure memory erasure or deletion of browser storage.
The site also uses third-party analytics and other services described in the privacy policy. You can use the transfer tool without creating an account; connection metadata and site usage still fall under those services’ data-handling rules. On a shared computer, check local history, temporary recovery settings and downloaded files before leaving.
A practical checklist before sharing
- Open the correct HTTPS site on devices you trust and use current browsers.
- Join the same room, verify the intended peer and set a room password when appropriate.
- Check the file channel and selected route. Keep Direct only if you do not consent to internet content relay.
- Keep both pages active and wait for the receiving-app receipt. The recipient must still save the download.
- On shared devices, clear local history and temporary recovery data using the available controls, and manage downloaded files separately.
For confidential workplace documents, follow your organization's approved transfer process. Textunnel's published acceptance record documents functional checks, not an independent security certification. For step-by-step sending instructions, use the same-Wi-Fi guide.