LocalSend does what AirDrop does, across every platform: Windows, macOS, Linux, Android and iOS. Open it on two devices on the same network and they find each other; pick files, a folder or a snippet of text, choose the receiver, and it arrives at full local network speed. There is no account, no upload to a server and no internet connection needed, which makes it just as useful for moving a phone's photos to a Linux laptop as for sharing a file in an office with no shared drive.
Transfers go device to device over HTTPS, with a TLS certificate generated on each device, using an open protocol the project documents separately. Recent versions add a command-line client, localsend-cli, for sending files or text from a terminal or script, plus a portable mode and a start-hidden option for the tray.
It is one of the most starred apps on GitHub, with about 94,900 stars and 246 contributors, at v1.18.2 when scanned. It is Apache-2.0, built with Flutter, with its newer core and CLI written in Rust.
- Repository: github.com/localsend/localsend
- Licence: Apache-2.0 (Apache License 2.0)
- Language: Dart. Stars: 94.9K. Forks: 5,315. Last push: Oct 17, 2026.
- Scan: safe, Oct 19, 2026, commit d01fdb1
Who it is for
Anyone who moves files between devices from different makers, such as an iPhone and a Windows PC or an Android phone and a Mac, and wants it to be as easy as AirDrop without a cloud service in the middle.
Getting started
1. macOS (Homebrew)
brew install --cask localsend2. Windows (winget)
winget install LocalSend.LocalSend3. Linux (Flathub)
flatpak install flathub org.localsend.localsend_appPhones get it from the App Store, Google Play or F-Droid. The project recommends a store or package manager because the app has no auto-update of its own. If devices cannot see each other, allow port 53317 (TCP and UDP) through the firewall and make sure the router's guest or AP isolation mode is off.
Safety scan
We cloned localsend/localsend at commit d01fdb1 on Oct 19, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- The one secret hit is a test checking that a freshly generated key starts with BEGIN PRIVATE KEY; there is no real key in the repository. No suspicious code patterns and no bare-IP URLs.
- The 3 committed binaries are Microsoft's Visual C++ runtime DLLs (msvcp140.dll, vcruntime140.dll, vcruntime140_1.dll), copied into the portable Windows ZIP build. They are Microsoft's redistributable files, not project code.
- The scanner counts JSON, Rust and the platform shells, not Dart, so its line total leaves out the Flutter app, and its advisory lookup covers Cargo.lock but not the Dart pubspec.lock. The 8 Rust advisories (3 moderate, 2 low, 3 unrated) are in the TLS and HTTP libraries (rustls, rsa, h2) and an unmaintained serializer; none is rated high.
- The only outside host worth a look, store.rg-adguard.net, appears in a build-support script for fetching Microsoft Store dependencies when packaging the Windows MSIX. The app itself contacts no server.
- 18 workflows, none using pull_request_target; only 3 of 33 third-party actions are pinned to commits, which is weaker than it could be. Licence, contributing guide and Dependabot present; no security policy.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | 1 candidate found and read; see the notes above. |
| Suspicious code | None found. |
| Install-time code | 1 Cargo build script. 2 installer scripts |
| Committed binaries | 3 executable or compiled objects committed; listed under the raw findings. |
| CI workflows | 18 workflows. None use pull_request_target. 30 of 33 third-party actions pinned to a tag rather than a commit. |
| Network hosts | 9 distinct hosts referenced from source; most often github.com, developer.apple.com, www.microsoft.com, stackoverflow.com. No URLs to bare IP addresses. |
| Known vulnerabilities | 8 advisories across 513 pinned packages: 0 critical, 0 high, 3 moderate, 2 low, 3 unrated. Cargo.lock: 513 packages, 8 advisories. |
| Project hygiene | Has automated dependency updates, licence file, contributing guide. Missing security policy, CodeQL. |
| OpenSSF Scorecard | Not scored: the project is not in Scorecard's weekly index. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Secret candidates (1, redacted)
| Where | Rule | Match |
|---|---|---|
| packages/core/src/crypto/cert.rs:248 | private-key | -----B…--- (27 chars) |
Installer scripts (2)
Committed binaries (3)
support/build/windows/x64/msvcp140.dll: PE (Windows executable), 578 KBsupport/build/windows/x64/vcruntime140.dll: PE (Windows executable), 109 KBsupport/build/windows/x64/vcruntime140_1.dll: PE (Windows executable), 50 KB
Worst known vulnerabilities (8 of 8)
| Advisory | Severity | Package | Summary |
|---|---|---|---|
| GHSA-4grx-2x9w-596c | moderate | rsa@0.9.10 | Marvin Attack: potential key recovery through timing sidechannels |
| GHSA-2mjx-qc3c-rqvc | moderate | rustls@0.23.43 | Rustls: TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries |
| GHSA-c8m5-c952-6cm4 | moderate | rustls@0.23.43 | `Debug` impls for client session values expose TLS secrets |
| GHSA-h2v8-394m-p7vv | low | rustls@0.23.43 | Brotli certificate decompression can allocate up to 1 GiB before authentication |
| GHSA-w44r-93j7-qv28 | low | rustls@0.23.43 | Unauthenticated ServerHello can downgrade later connections to classical key exchange |
| RUSTSEC-2025-0141 | unknown | bincode@1.3.3 | Bincode is unmaintained |
| GHSA-q83h-524g-xf6h | unknown | h2@0.4.15 | h2 unbounded empty DATA frames |
| RUSTSEC-2026-0253 | unknown | lru@0.18.1 | Potential use-after-free due to lack of panic safety in `LruCache::pop()` |
By the numbers
| Stars | 94.9K |
|---|---|
| Forks | 5,315 |
| Contributors | 246 |
| Commits | 2,169 |
| Open issues | 879 |
| Open pull requests | 139 |
| Releases | 27 |
| Latest release | v1.18.2 |
| Licence | Apache-2.0 |
| Main language | Dart |
| Project age | 3 years |
| Last push | Oct 17, 2026 |
| Tracked files | 1,029 |
| Lines of code | 72.7K |
| Checkout size | 16 MB |
Lines by language: JSON 32.8K, Rust 31.3K, YAML 2,576, Markdown 1,507, Kotlin 888, C++ 815.
Questions
Is LocalSend free?
Yes. LocalSend is free and open source under Apache-2.0 on every platform, with no ads, no account and no paid tier. The project is funded by donations and sponsors.
Does LocalSend work without the internet?
Yes. Both devices only need to be on the same local network, such as the same Wi-Fi or a phone hotspot. Files go directly between them and never pass through a server.
Is LocalSend secure?
Transfers are encrypted with HTTPS using certificates generated on each device, and by default you accept or decline each incoming transfer. As with any local sharing tool, be careful on public Wi-Fi, where other people's devices can see yours.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.