toss

[toss logo: a figure throwing a glowing file]

toss

Send files to your own devices and your friends, peer to peer. No IP addresses to type, no accounts, and your files never sit on a server.

Pair once with a short code, then toss files by name from any network. Run toss to open the window: drag files onto it (or click Toss) and pick a device. Closing the window keeps toss receiving from the tray. Right-click the tray icon to start toss at login, use it with Claude Code and, on Windows, add it to Explorer's Send to menu. (On GNOME the tray needs the AppIndicator extension.)

The same from the command line:

toss invite laptop                     # prints a code like 48213-otter-violintoss join 48213-otter-violin desktop   # on the other devicetoss send laptop report.pdf photos/ # files and folderstoss listen                         # receive (keep it running)

Also toss contacts, toss forget <name>, toss phone and toss relay. Answer always to auto-accept a contact.

Phones, no app

Click Phone (or run toss phone [file]...) and scan the QR code. The phone's browser opens a page served by your computer: it downloads the files you offer and sends files back into your Downloads folder.

• Same network only, and not encrypted: it's plain HTTP, because browsers don't trust certificates a home computer can make. A one-time secret guards the link, the link dies when you leave the page, and only the first browser to open it gets in. Use it at home, not on public Wi-Fi.
• The first time, allow toss through the Windows firewall. On an iPhone, downloads land in Files › Downloads.

AI assistants (MCP)

toss mcp lets an assistant like Claude send files to your devices: "send the chart you just made to my laptop". It can list your paired devices, send to them, put files on your phone ("put this on my phone": the toss window shows a QR code to scan), and see what arrived lately ("open the photo my phone just sent"; toss keeps the names of the last 50 arrivals in its folder for this). Nothing else: pairing, removing devices and settings stay with you, and someone on the other device still accepts each transfer, unless it takes files from yours without asking. The toss window shows what assistants sent.

What an assistant reads can steer it, so toss decides what leaves, not the assistant. Files from the folders you name go at once. For anything else, and for files that look like secrets (keys, .env, password databases) even inside those folders, toss asks you itself: in a window of its own that no assistant or app can answer for you, or through the assistant's app on a computer without a screen. The question shows where the files really are and how much would go. Tick Don't ask again to let a folder through from then on; the tray lists those folders, and clicking one takes it off. toss's own folder, with your device key, never goes. toss knows secrets by their file names, not their contents, so keep other secrets out of the folders you allow. How this holds up against prompt injection, on five open models (with a project folder allowed, nothing leaked in 224 injected trials, though some models fell for the injection most of the time): evals/injection.

Claude Code: installed on Windows, toss adds itself (tray menu: Use with Claude Code) and asks you before every send. By hand: claude mcp add toss -- toss mcp ~/projects. Claude Desktop: download toss.mcpb from Releases, open it and pick the folders. Other assistants (Cursor, ...) take it in their MCP config:

{ "mcpServers": { "toss": { "command": "toss", "args": ["mcp", "/path/to/projects"] } } }

Where the assistant supports it, a send runs as a task, so waiting for someone to accept can't time out. Progress shows while files move, and a cancelled send resumes the next time. It's in the MCP Registry as io.github.plamen-g/toss.

Privacy

Transfers are encrypted end to end (QUIC with TLS 1.3 and a post-quantum X25519 + ML-KEM-768 key exchange): only the receiving device can read your files, or even their names. Others can see that you transfer:

To show less:

• Run your own relay (below) and toss never contacts n0. Without one, even devices on the same Wi-Fi use n0 to find each other.
• A removed device still knows your device ID, so it can see when you're online. Delete the key file in toss's config folder for a new identity, then pair again.
• A pairing code works like a ticket: whoever uses it first is paired, and a wrong guess uses it up. Give it only to the person you mean, by voice or a channel you trust.
• macOS and Linux don't mark received files as downloaded, so the window offers Show in folder there, not Open.

Install

The quickest way, with no security prompts: paste one line into PowerShell on Windows, or Terminal on a Mac. It downloads the newest release from this repository and installs it, so run it only if you trust this repository.

irm https://raw.githubusercontent.com/plamen-g/toss/master/install.ps1 | iex

curl -fsSL https://raw.githubusercontent.com/plamen-g/toss/master/install.sh | sh

Or download it:

Windows: download toss-windows-x86_64.exe and open it: toss installs itself, with a Start menu entry, starting at login, and Claude Code if you have it. Opening a newer download updates it. It isn't signed yet, so Windows asks first: click "More info" → "Run anyway".

Mac: download toss-macos.dmg (any Mac), open it and drag toss onto Applications. It isn't signed by Apple yet, so the first time macOS won't open it: go to System Settings → Privacy & Security and click Open Anyway. In the terminal it's /Applications/toss.app/Contents/MacOS/toss.

Linux: put toss from Releases on your PATH.

When a new version is out, the tray menu offers Update to it. On Windows and Mac toss downloads it, checks its signature against toss's release key, and restarts as the new version; on Linux it opens the release page.

To build it: cargo build --release (about 14 MB). On a Mac, sh macos/bundle.sh then makes target/release/toss.app and toss-macos.dmg.

Keys and contacts live in %APPDATA%\toss, ~/.config/toss or ~/Library/Application Support/toss, or wherever TOSS_HOME points.

Use your own relay

Run iroh-relay on a server with a hostname (iroh-relay --config-path relay.toml, open TCP 80 and 443 and UDP 7842):

enable_relay = trueenable_quic_addr_discovery = trueaccess.shared_token = ["<long random token>"]  # only your devices may use it
[tls]hostname = ["relay.example.com"]cert_mode = "LetsEncrypt"contact = "[email protected]"

Then on every device: toss relay https://relay.example.com <token>, or deploy the relay.json it writes. toss relay off undoes it. Devices only reach each other through the same relay.

Always-on receiver

Pair a server once, answer always, and keep toss listen running; with nobody to answer, only auto-accept contacts get through.

# /etc/systemd/system/toss.service, then: systemctl enable --now toss[Unit]After=network-online.targetWants=network-online.target
[Service]ExecStart=/usr/local/bin/toss listenRestart=on-failureStandardInput=null
[Install]WantedBy=multi-user.target

How it works

• Built on iroh: a device is its public key. Connections go straight through NATs when they can, otherwise through an encrypted relay.
• Every connection opens with a signature over its own TLS keys, so a contact can't be faked or replayed. Pairing codes are short: the number says where the two devices meet, and the two words are checked with SPAKE2, a password-authenticated key exchange, so someone listening learns nothing and a guess has one chance in 65,536.
• Received files can't land outside Downloads, never overwrite anything (name (1).ext), get names that work on every OS, and on Windows carry the "downloaded from the internet" mark. Strangers are turned away, and free space is checked first.
• Big files stream in 256 KB pieces, so memory stays around 10 MB however large they are. A broken transfer resumes when you send the same files again, after both sides compare a BLAKE3 hash of what already arrived. Partials wait in Downloads/.toss-incoming; delete abandoned ones by hand.

Not yet

Nearby discovery, the macOS download flag, drag and drop on Wayland.

MIT licensed. Display font: Bricolage Grotesque (SIL Open Font License, assets/OFL-BricolageGrotesque.txt).