# DropToPhone security

DropToPhone uses QR pairing, short-lived sessions and encrypted WebRTC DataChannels for browser-based file transfer. A TURN relay may assist blocked networks, but DropToPhone is not designed as a cloud file library.

## Important security facts

- QR codes contain a high-entropy, short-lived join token.
- Manual pairing codes are short-lived and rate limited.
- File bytes use encrypted browser transport when a route is available.
- The application confirms receipt before showing completion.
- Users should compare the pairing code on both devices before sending sensitive files.
- Responsible disclosure contact: info@droptophone.com