How a Browser Pulls Off Peer-to-Peer File Transfers Without a File System or Listening Port
A browser-based P2P transfer tool that hits native speeds removes the last reason to install a separate app for cross-device file sharing, especially on locked-down machines. The architecture demonstrates that a single Rust core can drive desktop, mobile, and wasm targets without duplicating protocol logic, and the hard-won lessons around certificate rotation, secure context failures, and SCTP throughput limits are directly applicable to anyone building real-time browser applications.
A browser tab can now send and receive files directly between devices, no install required, matching the experience of native tools like LocalSend but working across networks. SwarmDrop achieves this by pairing three browser capabilities that were never designed to work together: WebRTC for NAT traversal and initial contact, WebTransport for a 4.5x faster same-network path, and the Origin Private File System for persistent, seekable on-disk storage that makes resumable transfers possible. The same Rust core runs across desktop, mobile, and browser, with platform I/O abstracted behind a handful of interface methods.
The WebTransport integration delivered a median throughput of 322 MiB/s in loopback tests, up from 72 MiB/s over WebRTC, while collapsing speed fluctuation from a 6.6x range to ±7%. On real hardware, a phone pushing to a browser over LAN hits roughly 20 MB/s, putting the browser's receive path on par with native QUIC between two devices. The send direction lags at about 9 MB/s because wasm's single-threaded file reads and checksum computation cannot yet overlap with network writes.
Several sharp edges emerged during development. WebTransport's self-signed certificates expire after 14 days, forcing a dual-certificate rotation strategy that doubles address lifespan to 28 days. The secure context requirement silently disables OPFS and Web Crypto when a page loads over plain HTTP to a private IP like 192.168.x.x, causing writes to hang forever with no error. And WebRTC's SCTP-based DataChannel, optimized for low-latency signaling rather than throughput, remains the only option for cross-network transfers because WebTransport still lacks a NAT traversal mechanism.
WebTransport's 14-day certificate limit is the kind of constraint that looks like a footnote but reshapes the entire address distribution model, forcing a time dimension onto something that was previously static config.
A Promise that hangs forever because the API object is undefined is a worse failure mode than an exception; the secure context trap on private IPs will waste days for anyone who hits it without knowing to check isSecureContext first.
WebRTC's SCTP layer is optimized for signaling latency, not bulk throughput, which means any browser app moving large files over DataChannel will hit a hard ceiling that no amount of JS tuning can fix.
Keeping the browser send path non-resumable is the correct call: restoring a session that can't reopen its source file produces a progress bar that can never finish, which is worse than starting over.
The 4.5x speedup from WebTransport matters less than the collapse in variance; users perceive a stable 300 MiB/s as dramatically faster than a connection averaging the same speed but swinging between 44 and 288.