KEIBIDROP

What You Get

*A relay server is used to exchange ephemeral public keys between peers and to track how many people use the service. It does not route traffic, store files, or see any plaintext data. Once the handshake completes, the relay is out of the picture; peers talk directly to each other.

How It Works

1. Start KEIBIDROP on both devices

   Each device generates a unique cryptographic fingerprint. This is your identity for this session.

   

   Home screen with generated fingerprint
2. Exchange codes via any channel

   Copy your code and send it over Signal, Telegram, email, whatever. Your peer does the same. Paste their code and hit Add.

   

   Registering the peer's fingerprint
3. Create or join a room

   One peer creates, the other joins. Direct IPv6 connection established. Hybrid post-quantum handshake completed in under 3ms.

4. Share files

   Drag files into the window or use the CLI. They appear on the other side in real time. With FUSE mode, shared files show up as a virtual folder in Finder or your file manager.

   

See It In Action

FUSE mode: files appear as a virtual folder

No-FUSE mode: drag and drop, save buttons

Three Interfaces

Interactive CLI

Interactive CLI session: register peer, create room, share files

All three interfaces support FUSE (virtual folder) and no-FUSE (explicit add/pull commands) operation.

Under The Hood

Privacy

KEIBIDROP sends no analytics, no crash reports, no usage data. Identity is a cryptographic key pair generated locally. Keys rotate on every disconnect; your fingerprint changes and previous sessions cannot be linked to new ones.

The relay exists only to exchange ephemeral public keys between peers. It stores encrypted blobs it cannot decrypt, indexed by a lookup token derived from the fingerprint (not the fingerprint itself). It cannot correlate registrations. After the handshake completes, the relay is no longer involved.

Session keys are rekeyed automatically after 1 GB of data or 1 million messages. If a key is compromised, only a fraction of the session is exposed. Every line of code is auditable under MPL 2.0.

Get Started

Interactive CLI

# Terminal 1 (Alice)
export KEIBIDROP_RELAY=https://keibidroprelay.keibisoft.com
export TO_SAVE_PATH=./SaveAlice TO_MOUNT_PATH=./MountAlice
./keibidrop-cli

keibidrop> register <Bob's fingerprint>
keibidrop> create
keibidrop> add /path/to/file.pdf

# Terminal 2 (Bob)
export KEIBIDROP_RELAY=https://keibidroprelay.keibisoft.com
export TO_SAVE_PATH=./SaveBob TO_MOUNT_PATH=./MountBob
./keibidrop-cli

keibidrop> register <Alice's fingerprint>
keibidrop> join
keibidrop> list
keibidrop> pull file.pdf ./SaveBob/file.pdf

Agent CLI (kd)

The kd tool runs as a background daemon. All commands return JSON. Designed for Claude Code and similar AI agents.

# Start daemon (FUSE mode recommended for agents)
KD_SAVE_PATH=./saved KD_MOUNT_PATH=./mount \
  KD_SOCKET=/tmp/kd.sock ./kd start

# Exchange fingerprints and connect
./kd show fingerprint
./kd register <peer-fp>
./kd create

# After connecting, the mount path is a live synced folder
ls ./mount/
cat ./mount/readme.txt
cp ./myfile.pdf ./mount/

# Cleanup
./kd disconnect
./kd stop

Full reference: Agent Integration Guide

Desktop GUI (Rust + Slint)

export NO_FUSE=1  # omit for FUSE mode
export TO_SAVE_PATH=./SaveAlice TO_MOUNT_PATH=./MountAlice
./keibidrop-rust

FFI (embed in your app)

KEIBIDROP compiles to a C static library (libkeibidrop.a + libkeibidrop.h). Call from Rust, Swift, Python, or any language with C FFI.

KD_Initialize(relay, inbound, outbound, mount, save, fuse, prefetch, push);
KD_AddPeerFingerprint(peer_fp);
KD_CreateRoom();
KD_AddFile("/path/to/file.pdf");
KD_SaveFileByName("file.pdf", "/save/path/file.pdf");

Built With

• Go 1.24 for backend, networking, cryptography, FUSE. Standard library crypto/mlkem for post-quantum.
• Rust + Slint for the native cross-platform desktop UI. No Electron. 20MB binary.
• gRPC + Protocol Buffers for type-safe peer communication.
• cgofuse for cross-platform FUSE bindings (macOS, Linux, Windows).

~11,000 lines of Go (plus ~5,000 lines of tests). 10 months, two developers, Claude as a coding partner since November 2025.

The KEIBIDROP Blog Series

• Building Post-Quantum Encrypted File Sync
  Full technical overview. Architecture, crypto choices, FUSE challenges, lessons learned.
• Debugging FUSE Deadlocks on Intel Macs
  Lock ordering and brief-lock patterns that saved us from frozen filesystems.
• Hybrid Post-Quantum Encryption for gRPC
  ML-KEM + X25519 handshake. Custom transport credentials. 3ms overhead.
• Privacy-Preserving P2P Discovery
  Dual key derivation, encrypted registration blobs, and why the relay sees nothing.
• Forward Secrecy: Automatic Key Rotation
  Rekey after 1 GB or 1M messages. Counter-based nonces. Hybrid ML-KEM + X25519 rekey.
• Building a CLI for AI Agents
  The kd tool: daemon + Unix socket, JSON output, direct function calls.
• Testing P2P Systems Without External Dependencies
  Mock relay, TestPair harness, dynamic ports, 36 tests in 139 seconds.
• Cross-Platform File Sync
  macOS atomic saves, Windows file locking, Linux FUSE versions.
• Building KEIBIDROP While Burned Out
  519 commits, 10 months, two developers. Building during recovery.
• The Write/Release Race Condition
  When the kernel closes your file mid-write. Timestamp debugging and RWMutex.
• 10x FUSE Performance via Block Size Tuning
  One line change: st_blksize 4KB to 2MB. 300 MB/s to 3,400 MB/s.
• Making Git Work Inside a FUSE Filesystem
  mmap, fsync races, fcopyfile quirks, per-file direct_io.
• Why macOS Preview Can't Read Your FUSE Files
  Three-layer debugging: sandboxing + Gatekeeper + mmap.

Open Source

KEIBIDROP is free and open source under the Mozilla Public License 2.0. The source code is available for inspection, cryptographic audit, and building from source.

Commercial licensing, priority support, custom integrations, and private relay hosting available for organizations.