What is PC to iPhone Share?

It is an open-source utility that serves one folder from your Windows, macOS or Linux computer over local HTTPS, so your iPhone or Android browser can download from it after signing in with a generated password. There is no cloud upload, cable, account or phone app involved.

Does it need internet access?

No. The running app needs only a reachable local network. Downloading the app itself the first time needs internet, but transfers do not.

Can my phone upload files back to the computer?

No. This version is download-only, from computer to phone. There are no upload, delete, rename or edit endpoints in the API, which is a deliberate security property rather than a missing feature.

Why does my iPhone ask me to trust a certificate?

A private LAN address has no publicly trusted identity, so no public certificate authority can vouch for it. Pairing with the computer's own local CA gives the browser something to verify the HTTPS connection against. Trust on the computer does not transfer to the phone automatically, so you enable it once in Settings.

Where do the downloads go on an iPhone?

Check Safari Downloads or the Files app. Downloading media does not automatically import it into Photos or Music.

Does it work over the internet or on mobile data?

No. Internet sharing, IPv6-only networks, mobile server hosting and 32-bit desktop builds are outside this alpha's scope. It binds one selected private IPv4 interface and accepts peers within that subnet.

PC to iPhone Share

Overview

Getting a file from a laptop onto a phone usually means uploading it somewhere and downloading it again, or finding a cable. Both are disproportionate when the two devices are on the same Wi-Fi. This serves a single folder you pick over HTTPS on your local network: pair the phone once with the computer's own certificate, sign in with a generated password, and download in Safari or an Android browser. It is deliberately download-only and read-only — there is no upload, delete, rename or edit endpoint in the API at all.

What it does

Serves one folder you choose, read-only, over TLS 1.2+ on one selected private interface
Per-installation local certificate authority; the private key never leaves the computer
Random share password stored only as a salted PBKDF2-HMAC-SHA256 hash at 600,000 iterations
No upload, delete, rename or edit endpoints exist — the API surface is downloads and nothing else
Go os.Root containment, rejecting traversal, symlinks, junctions, alternate data streams and invalid names
Streaming with HTTP byte ranges, so a large file resumes rather than restarting
No cloud relay, UPnP, port forwarding, telemetry, request logging or automatic update checks
Go standard library only — no third-party Go modules in the server

Quickstart

Run it

Extract the release archive and start the launcher for your platform. The console prints a private management URL with the generated password.

./pc-to-iphone-share

Build from source

git clone https://github.com/dibyapp/pc-to-iphone-share.git
cd pc-to-iphone-share
go build -trimpath -buildvcs=false -o pc-to-iphone-share .
./pc-to-iphone-share --help

Verify the source

go test ./...
go vet ./...

Optional guided install

Detects your CPU and OS and verifies release checksums. It does not launch the app or overwrite an existing installation.

python scripts/install.py --dry-run
python scripts/install.py

The five steps of a first transfer

Start the launcher on the computer, choose one folder, and select the private interface your phone can actually reach. The console prints a management URL — keep that one on the computer.

Join the phone to the same network and pair it once with your computer's public certificate. On an iPhone this means explicitly enabling trust for that certificate in Settings; a private LAN address has no publicly trusted identity, so without this step the browser has nothing to verify the HTTPS connection against.

Then open the separate phone URL, enter the password, and tap a filename. Ctrl+C or the stop control ends sharing. Nothing is left running: the app never changes firewall or router rules, installs trust on your behalf, or registers a background service.

Why a certificate step at all

This is the part people most often want to skip, and it is the part that makes the rest meaningful. HTTPS to a local IP address cannot be validated by a public certificate authority, because no public authority can vouch for 192.168.x.x. The options are an unverified connection, or your own authority that the phone is told once to trust.

The project takes the second route and keeps it manual: a per-installation constrained local CA, a private key that stays on the computer, and a fingerprint you verify by hand. Trust established on the computer does not silently extend to the phone — you grant it explicitly, for your own certificate.

Download-only as a security property

Most local-sharing tools are bidirectional, which means the surface facing your phone can also write to your computer. Here that surface does not exist: there is no upload, delete, rename or edit endpoint to find a flaw in.

Beneath that, Go's os.Root confines access to the chosen folder, and traversal attempts, symlinks, junctions, alternate data streams and invalid names are rejected rather than resolved. Only regular files are served, as attachments. Sessions are Secure, HttpOnly and SameSite=Strict with idle and absolute expiry and revocation on logout or restart, with login throttling and bounded resources behind them.

The honest limits are stated too: a subnet check does not prove physical Wi-Fi membership, administrators and hard links have their own boundaries, and there has been no independent security audit.

Where it fits against the alternatives

This is a focused workflow rather than an AirDrop replacement. It does one thing — download from one computer folder to a phone browser — and the README points at LocalSend, PairDrop, croc and copyparty for general device-to-device transfer, uploads, remote transfers or a richer server.

Current scope is an unsigned alpha. Windows x64 and Ubuntu 24.04 x64 under WSL 2 have passed local runtime tests; CI covers every packaged architecture, but physical phone and LAN checks, signing and notarisation remain separate. Internet sharing, IPv6-only networks and 32-bit builds are out of scope for this release.