Reference

Questions

What is Warp Gate?

A temporary encrypted bridge between browsers. One device opens a gate, others join with the link or QR code (a gate seats up to six devices; two is the common case), and from then on messages and files pass directly between the devices. When the gate closes, the keys and the room are gone.

Is there an app to install?

No app, and no account. It's a web page, and that's the point.

There is one optional extra: a browser extension. It carries the client inside the package instead of downloading it, which closes the one gap nothing else can. Whoever serves you the page controls the code that holds your keys, so if you don't want to trust the server on every visit, the extension is the answer. Download the zip, unpack it, and load the folder: it isn't in any store, so nothing auto-updates, and it doesn't have to be installed for the site to work. One thing it gives up: it can't stream a download, so on a browser without a save-file dialog a file over 500 MB can't be received in the extension.

Who can read what I send?

The devices in the gate, and nobody else. Everything is encrypted in your browser before it is sent, and the server never receives the keys, the messages, the files, or even the file names. Anyone who holds the gate link is a participant, so who can read what you send is decided by who you give the link to. What the server can see is set out in the Privacy Policy.

Is this the only official Warp Gate?

Yes. https://warpgate.fysh.site is the only instance we run. The source is public, so anyone may host their own copy, and we think that is a good thing. But an instance run by somebody else is not ours: we cannot audit it, vouch for it, or know it exists. It inherits none of the trust that this one has earned.

Check the address bar before you send anything sensitive.

How do I know the person hosting it is not malicious?

Bluntly: if you did not host it yourself, you cannot know.

The server sends the JavaScript that does the encryption, so whoever runs the server controls that code. A hostile operator does not need to break the cryptography: they can serve a modified page that copies your messages straight back to them, and it would look exactly like this one. The verification code cannot catch that either, because the same modified page draws it.

This is true of every web application that encrypts in the browser, not just this one. It is why the honest statement is "trust the operator", not "trust the maths". If you need certainty, host it yourself from source you have read. Warp Gate has no dependencies and no build step precisely so that this is realistic: the files served are the files in the repository, and there are about fifty of them.

Can I run my own?

Yes, and it is deliberately easy. It is one Node process with no dependencies, no build step and no database:

git clone <repository>
cd warp-gate
node server/index.js        # serves on port 3095

Put it behind TLS, point WG_STUN_URL at a STUN server, and that is the whole deployment. See deploy/SELF-HOSTING.md in the repository.

If you modify it and let others use it, the AGPL requires you to offer them your source. Set WG_SOURCE_URL to where your copy lives and the page will link to it; the server warns at startup if you have not.

What licence is it under?

GNU Affero General Public License, version 3. You may run it, read it, modify it and host it. What the AGPL adds over an ordinary open licence is section 13: if you run a modified version and let other people use it over a network, you must offer those users the source of your modified version.

That matters here more than it usually does. The honest answer above is that you cannot verify a host is not malicious, because they control the code. The licence does not fix that, and nothing can. What it does is make hiding a modification a licence violation rather than merely rude, and it obliges an honest operator to publish what they changed. Every instance should offer a "Source" link; if one does not, that is worth noticing.

How many people can one server handle?

More than you would expect, because the server drops out of the data path once two devices connect. Files and messages never touch it, so their size and volume cost it nothing. The only thing that costs it anything is the number of gates open at once.

Measured on one process: 2,000 gates open simultaneously, which is 4,000 live connections, using about 198 MB of memory, or roughly 66 KB per gate. Relayed handshake messages were still delivered normally at that load. The default configuration caps concurrent gates at 200, which uses a few megabytes; raise WG_MAX_ROOMS if you need more.

In other words a Raspberry Pi will do, which was the design target.

How many people can be in one gate?

Up to six devices (the operator can configure the cap; six is the default and what the official instance runs). Two is still the common case. Every device that takes a seat must first prove to the server that it holds the link secret, and every pair of devices in the gate connects directly with its own keys, so a bigger gate is more connections, not a shared channel.

Why does it say the devices see each other's IP address?

Because they connect directly to each other, which is what keeps the server out of the data path. That is a deliberate trade. Warp Gate is confidential, not anonymous.

Can someone standing behind me just read the link and join?

Much less easily than before. The secret is not left in the address bar: it is stripped as soon as it has been used, and the code and QR are hidden until you choose to show them. So nothing sensitive is sitting on screen during the session.

It cannot be eliminated entirely, because at some point you have to show or send the code for another device to join. Three things limit the damage: nobody can take a seat without the link secret, so a glance at your screen that does not capture the whole code gains nothing; the devices at each end of a connection display a verification code you can compare aloud, so a substitution is detectable; and a room password means reading the code is not enough on its own. Use one if people can see your screen.

What is the room password for?

It is a second factor on top of the link. The link already contains an eight-word code worth 103 bits, stretched into a 128-bit secret with 600,000 rounds of PBKDF2, and is the main credential; the password helps if the link itself might be seen by someone else, for example when it is pasted into a group chat. It is stretched with 600,000 rounds of PBKDF2 and never leaves your browser. The server only ever learns that a gate has one, as a yes or no, so that it knows to ask.

Why did my connection fail?

Open "Connection details" or the technical detail on the failure screen: it says which of the specific causes applies rather than guessing. The common ones are a browser setting that blocks WebRTC, a network that blocks peer-to-peer traffic, and a strict mobile carrier NAT. Putting the devices on the same network almost always works.

How big a file can I send?

Sending has no limit in any browser. Receiving depends on the receiving browser. On a Chromium desktop browser a large file is written straight to a location you choose, as it arrives, and an interrupted transfer continues into the same file: a dropped connection picks up where it left off, and so does a reload. On other browsers, a file over 500 MB is handed to the browser's own download manager and written straight to disk as it arrives, so there is still no size limit, but it goes to your usual downloads folder. A dropped connection still carries on by itself; reloading the page is what loses the partial file, because the browser owns it and will not hand it back. Only a browser that supports neither route holds the file in memory, capped at 500 MB, and Warp Gate refuses before the transfer starts rather than failing near the end.

How long does a gate last?

The time you pick is an idle timeout, not a deadline. While anyone is still on the gate page the clock keeps being pushed forward, so a long file transfer or a long conversation is never cut off part-way through, and a gate that everybody has left is reaped within a minute or so. There is a 24 hour cap as a backstop; a gate with at least two devices actually attached can keep pushing that cap back, up to an absolute limit of three days that nothing can move, and the gate warns everyone in the final fifteen minutes before that limit rather than simply vanishing.

Does it keep any history?

The server writes nothing to disk, ever: it holds a room in memory only, and a restart destroys every gate. Your own browser keeps only the small bookkeeping items listed in the Privacy Policy: your acceptance of the Terms, the session's token and secret for a gate that is currently open, and, during a file transfer, a resume record that never contains the file's contents. Received files exist only where you save them.

One deliberate exception on your own screen: after a gate is burned, what was exchanged stays readable in that tab, so that a dropped connection does not mean running the whole thing again just to re-read a password you already received. It is never written to storage, never sent anywhere, and it disappears when you close or reload the page. There is a "Clear this now" button if you want it gone sooner.

Do you moderate what people send?

We cannot. Everything is encrypted between the devices, so there is nothing for us to inspect even in principle. Responsibility for what you send rests with you, as set out in the Terms of Use and the Acceptable Use Policy.

Is it free?

Yes. Nothing in a gate is advertised to or tracked: that page is served with a policy that permits no other origin at all, so no third-party script can run there. The front page is a separate document and may carry a sponsor; the Privacy Policy says exactly where the line is. If you want to help with the running costs there is a support section on the front page.

Back to Warp Gate · FAQ · Terms · Acceptable use · Privacy