PhoneToPC
Download
SECURITY MODEL

Private by architecture, not by slogan.

PhoneToPC keeps file custody on the paired Windows PC and makes the relay a narrow, authenticated connection layer. The system is designed to fail closed when that tunnel is unavailable.

Where files live

Photos and documents are stored in libraries on the paired Windows PC. The public relay maintains account metadata, device routing state and the active websocket tunnel; it is not used as file storage.

Pairing and credentials

  • Pairing uses a short-lived, single-use ticket.
  • Permanent PC API keys are never embedded in the public QR page.
  • Desktop secrets are generated per installation.
  • Android stores credentials with AES-GCM keys backed by Android Keystore.
  • Sensitive Android screens enable screenshot protection by default.

Relay and tunnel

  • The PC initiates an outbound authenticated websocket connection.
  • There is no direct-URL or LAN fallback from the public relay.
  • When no tunnel exists, the relay returns HTTP 503 instead of attempting another route.
  • Authentication and control request bodies are size-limited and rate-limited.
  • JWT issuer, audience, signature and lifetime are validated.

Uploads and media

  • Per-file, total-request and file-count limits are enforced.
  • Executable and script extensions are blocked by default.
  • Uploads stop before the PC reaches its minimum free-disk reserve.
  • Thumbnail decoding rejects oversized source files and extreme pixel dimensions.
  • Stored paths are resolved and checked against traversal outside the configured library.

Infrastructure

  • Relay container runs as UID/GID 10001:10001.
  • Read-only root filesystem, all Linux capabilities dropped and no-new-privileges.
  • Private relay data uses mode 700 directories and mode 600 files.
  • SSH password authentication is disabled on the VPS.
  • UFW and fail2ban are active; only ports 22, 80 and 443 are public.

Release security gates

The current release passed .NET and Android builds, custom security regression tests, remote reconnect tests, live tunnel verification and a real relay upload/list/delete smoke test. Dependency scans reported no known NuGet or OSV vulnerabilities at the audit date.

Read the complete 2026-07-26 hardening report.

Reporting a security issue

A public security-reporting mailbox has not yet been announced. Until it is available, do not publish credentials, pairing QR codes or exploit details publicly. Rotate affected credentials immediately from the PC host.