Pikepike
Open App
live · post-quantum p2p file transfer
>

The world's fastest, simplest, most secure post-quantum file transfer

I built Pike because file sharing is broken: you upload to someone else's server, wait, then download. Pike skips the server entirely. Files streamdirectly between two devices — browser to browser, terminal to terminal — sealed with hybrid post-quantum cryptography.
No account. No upload. No relay. The signaling exchange introduces the peers, then gets out of the way — not a single byte of your file ever touches a server.
zero cloud relaysno accountsML-KEM-768 + X255196-digit SAS verificationweb + CLI
Pikepiketransfer cockpit
Ready
01Senddirect p2p stream
Select or drop a file
your bytes never touch a server
02Receiveenter a share code
SAS Verificationpost-quantum
· · · · · ·
Both devices must show the same 6 digits. If they match, no man-in-the-middle is in the path — confirm to unlock the stream.
Capabilities & engineering guarantees
Direct P2P
Your bytes travel over a direct WebRTC DataChannel. The signaling exchange only introduces peers, then gets out of the way.
zero relays
Post-Quantum by Default
ML-KEM-768 (FIPS 203) hybridized with X25519 ECDH. “Harvest now, decrypt later” attacks have nothing to harvest.
FIPS 203
Zero Friction
Drop a file, share a 3-word code, verify a 6-digit SAS. No accounts, no configuration, no installs for the web app.
no signup
Web + CLI Interop
One Rust crypto core, every surface. The same handshake runs in the browser via WASM and in the terminal on macOS, Linux, Windows.
one protocol
How a transfer works
01
Generate a code
Drop a file and Pike creates a 3-word share code. Nothing is uploaded — the code is just a lookup key for the handshake.
02
Share the code
The receiver enters it in the app or CLI. STUN and the signaling exchange connect the two peers directly.
03
Verify the SAS
Both sides compare a 6-digit code. Match it, confirm, and the encrypted stream starts — authenticated end to end.
>

Post-Quantum Cryptography & Security Architecture

Every cryptographic primitive lives in a single Rust core, compiled to WebAssembly for the browser — so the web app and the CLI run the exact same handshake, key schedule and chunk cipher. What you see here is what runs in the terminal.
  • ML-KEM-768 (Kyber) — NIST FIPS 203 lattice-based key encapsulation. Quantum computers cannot break it, so your session keys are safe from future decryption.
  • X25519 ECDH — classical Curve25519 key agreement layered alongside ML-KEM. An attacker must break both to recover the session.
  • XChaCha20-Poly1305 AEAD — authenticated encryption with a per-chunk nonce. Every chunk is confidential and tamper-evident.
  • BLAKE3 KDF + Merkle tree — derives the session key from the shared secrets and verifies chunk integrity end to end.
  • 6-digit SAS verification — a short authentication string both sides compare out-of-band, making man-in-the-middle attacks visible.

Zero Server Storage Architecture

Pike never holds, buffers or stores your files on any server. STUN and the signaling exchange only introduce peers — once connected, the payload flows directly peer-to-peer. There is no server to subpoena, no cloud bill for your bandwidth, and nothing to delete when you're done.

>

CLI — Same Protocol, Terminal-Native

The exact same post-quantum stack, from your terminal. One binary, three ways to install — pick whichever fits your system:
Cargo (Rust toolchain)cross-platform
cargo install pike
macOS & Linux (curl)shell script
curl -fsSL https://pike.sh/install.sh | sh
Windows (PowerShell)iwr / iex
iwr -useb https://pike.sh/install.ps1 | iex