Before you begin
Use current Chrome, Edge, Safari or Firefox over HTTPS. Share relies on WebRTC, WebCrypto and IndexedDB; a restricted embedded webview may not expose the same APIs as a full browser. For local development, a plain LAN HTTP address is not equivalent to the secure localhost exception. Check browser permissions and organisational policies before testing advanced features.
A practical workflow
On a network where browsers cannot prove the direct local path, an optional node can issue short-lived signed tokens bound to a device. It runs inside the LAN under the network owner’s control. Attested connections may use configured STUN discovery, but TURN relays remain refused. A node does not add remote file delivery, permanent storage, or a guarantee that every restrictive network will connect.
Strict LAN verification
A shared public IP alone is never enough. Without a LAN-node attestation, automatic verification requires a direct connection using local host candidates. A configured LAN node provides a separate device-bound proof of LAN membership.
Questions that matter
Which browsers and devices are supported?
Current versions of Chrome, Edge, Safari and Firefox on Windows, macOS, Linux, Android, iOS and iPadOS. The browser needs WebRTC, WebCrypto and IndexedDB, and the page must be opened over HTTPS.
How does it know that devices are on the same LAN?
In automatic mode, a shared public IP only makes two devices candidates. Share verifies a WebRTC path using local host candidates — private, link-local or mDNS addresses — without STUN or TURN, and re-checks that path while connected. As a separate option, an administrator-run LAN node can attest devices with short-lived signed tokens. For those attested peers, configured STUN and non-relay candidates may be used; TURN relays are always refused.
What is a LAN verification node?
An optional small program you run on an always-on computer inside your network. Each browser visits its private address once and receives a short-lived signed token bound to that device. Devices holding tokens from the same node are grouped together even when the browser alone cannot prove the local path.
Open the page. That is the whole setup.
OKYA Share uses only standard browser technology, so there is nothing to install or configure.
- Join the same network: Connect your devices to the same Wi-Fi or wired LAN, then open share.okya.app in a modern browser.
- Devices verify each other: A lightweight signaling service introduces candidates. Automatic mode verifies a local host-candidate path; devices attested by a configured LAN node use a separate verification path.
- Share freely: Once verified, files, messages and screens flow directly between devices. Close the tab to stop sharing.
Connection and privacy
Messages and files are sent over WebRTC DataChannels, which are always encrypted (DTLS). TURN relays are disabled by design, so content can never be forwarded through a server.
If automatic local-path verification fails, Share shows a clear message instead of guessing. An optional administrator-run LAN node can attest devices separately; those attested connections may use configured STUN, but never a TURN relay. Network restrictions can still prevent a connection.