This project is largely AI generated, but based off of my work on [Noctis]{https://gitea.wildcardproject.com/zoeissleeping/noctis}. Its largely unsloppified currently, but that unsloppiness isnt too horrific like some other projects I've been working on and will need to heavily manually deslop.

My Slop Score: 5/10. It's not bad, but it's not great.

Quickdrop is secure self hosted file drop service. The goal is to take a file on your PC, upload it via Quickdrop, scane the QR code on your phone or share the link, and download the file with no additional software or setup and a zero-trust policy.

Deployment

Run one Node/Nitro process behind HTTPS and a Cloudflare proxy. Storage is local (QUICKDROP_STORAGE_DIR, default .data/quickdrop) and locks are in-process, so multiple workers, containers, or replicas are unsupported. Configure AUTH_PASSCODE, AUTH_SECRET (a long random secret), and optionally AUTH_TOKEN_TTL_DAYS; see .env.example. Use backups, disk monitoring, and Cloudflare/IP rate limits. Cloudflare request sizing is safe because upload and download requests are one encrypted chunk (about 8 MiB), not whole files.

The uploader and reservation APIs require the shared passcode. Room descriptors, lease claims, encrypted chunk reads, and completion are public capability APIs. A descriptor lookup does not consume a read. Explicit download claims one read; interrupted downloads reuse their active sessionStorage lease. Expiry starts only when finalize succeeds. Choices are 1h/2h/6h/12h/24h/7d and 1/5/10/20/50/100/unlimited reads.

Browser behavior

The File System Access API path writes and decrypts one chunk at a time and supports very large files without whole-file browser materialization. Browsers without it use a deliberately bounded Blob fallback: a warning appears above 100 MiB and files above 256 MiB require a supported desktop browser. Keep the upload tab open and do not share a link until finalize completes.

This service has no application total-file-size quota, but disk capacity and operational rate limits remain important. Existing legacy whole-body room drops are not compatible with protocol v2.