paironce
Send files and text from a terminal to your own phone or computer with PairOnce. Pair once with
a six-digit code; after that, npx paironce send report.pdf puts the file on your phone. End-to-end encrypted, direct
between the devices whenever the network allows, and through an encrypted relay when it does not. No account.
The other device is any browser with https://paironce.com open: iPhone, Android, Windows, Mac or Linux. Nothing to
install there.
Commands
--name "<name>" (or the PAIRONCE_NAME variable) sets what the other device shows for this one, for example
--name "Build server". The key stays the same, so paired devices still know it. --agent marks this device as an AI
agent on the other device (the MCP server always does). The MCP server stays connected for 30 minutes after its last tool call, so the next task needs no tap on your device; you see it as connected and can end it there. The MCP tools save inside the folder the server runs in (inbox by default). --ephemeral uses a throwaway identity in a temporary folder,
which the other device forgets after a day without a connection: right for a sandbox that is thrown away.
When a paired device is not connected, the command asks it to connect: PairOnce on that device shows
"Windows · Terminal wants to reconnect" with a Connect button.
Use it from an AI agent (MCP)
paironce mcp gives an agent ten tools:
The agent reaches only devices you paired and approved, and nothing arrives anywhere unasked. Your device marks it
Agent when it asks to be approved and in your saved devices. Design and plans:
Agent as a Device.
send_file does not send hidden files and folders (such as .env or .ssh), Windows's AppData, a Mac's Library or this
device's own PairOnce files; you can still send those yourself with paironce send. A file that arrives after receive_files
or a request stopped waiting is saved in the folder it was accepted for, and the next receive_files reports it. Changes in
each version are in the releases.
Claude Code:
Other clients (Cursor, Claude Desktop and others), in their MCP configuration:
Then ask: "pair with my phone", "send the build log to my phone", or let the agent ask you: "I need a photo of the label on the back of the router".
How it works
The CLI runs the same connection code as paironce.com: the PairOnce protocol
and @paironce/core for pairing and encryption, with WebRTC from
node-datachannel for direct connections and
@roamhq/wrtc (libwebrtc) for the relay. Files and messages are encrypted on this computer
and decrypted on the other device; the PairOnce service only introduces the two devices and, when needed, relays
encrypted bytes it cannot read.
This computer's device key and the list of paired devices are kept in ~/.paironce (or $PAIRONCE_HOME), readable only
by you. The private key never leaves this computer.
It connects directly whenever the networks allow it, otherwise through the encrypted relay over UDP, TCP or TLS on port
443, and where even that is blocked, through the PairOnce tunnel: the same encrypted data over a secure WebSocket to
paironce.com. So it works on servers, in containers that block UDP, and behind a web proxy (HTTPS_PROXY is used
automatically). In a cloud sandbox with an allow-list, such as Claude Code on the web, add paironce.com to the allowed
domains. PAIRONCE_DEBUG=1 shows each step of connecting.
Requires Node.js 22 or later on Windows, macOS (x64 and arm64) or Linux (x64 and arm64).
License
Apache-2.0. PairOnce is a trademark of its owner; see https://paironce.com.
