DeskShuttleThree questions deserve three answers
Where do the files travel? Who is allowed to request them? How does the receiver check the bytes? These questions are related, but answering one does not automatically answer the others. A local route can avoid a hosted relay while still needing a careful transport and access model.
DeskShuttle’s transfer server runs on the iPhone and serves a browser client over the local network. Files in this workflow do not pass through our transfer servers. The iPhone app must remain open, and both devices need a network route to one another.
The connection uses local HTTP
The app’s server uses HTTP rather than HTTPS. That is a material property of the connection, not a small print detail. Do not infer transport encryption from the fact that the file stays on Wi-Fi or from seeing a join code.
The browser asks to join with a six-digit code, followed by approval on the phone. The implementation also uses random session credentials and expires inactive access. These mechanisms restrict access within the application. They do not turn the underlying HTTP channel into an encrypted connection.
Integrity is about matching bytes
DeskShuttle computes SHA-256 digests for integrity checks. For the chunked path, the browser can check individual pieces and the assembled file. If the computed digest disagrees with the expected digest, the bytes should not be treated as a successful verified transfer.
The expected hash is part of the same local workflow. Hashing alone does not establish the identity of a remote peer or defend against every active network attacker. Nor does it judge whether a file is safe to open. The Transfer Lab makes the narrower property visible: altering one byte changes a digest, without hiding or encrypting the text.
A practical boundary for use
Use the app on a trusted local network. Keep access codes private, approve the intended browser connection and end the session when you are finished. For sensitive material, an untrusted network, or an organization that requires encrypted transport, choose an approved encrypted method that meets those requirements.
This note describes the inspected implementation, not an independent security audit or certification. The useful promise is specific: a local browser transfer workflow with explicit access approval and byte-integrity checks. Being precise about that boundary helps you decide when the tool fits, and when another route is more appropriate.