Filepunch GitHubv0.3.0
Coming soon · Open source · v0.3.0 on GitHub

Your device's files,
one punch away.

Peer-to-peer file access to a folder on a Linux device behind NAT. No open ports, no VPN, no bytes through a server.

View on GitHub Read the protocol

Free and open source under the Apache-2.0 licence, with code, specs and threat model on GitHub.

How a Filepunch session is set up Client and device each send a short signaling pulse up to the relay. Then a direct beam of data flows straight between client and device, through a hole in the NAT wall, while the relay carries nothing. relay NAT Client CLI · Go · browser Device filepunchd
Signaling goes through the relay. Files never do.
  1. 1A small agent on the device only connects outward. No port is opened.
  2. 2Your backend gives a client a short-lived pass for one device and one folder.
  3. 3A tiny relay introduces the two. From then on they talk directly.
  4. 4Files move straight between client and device, encrypted. The relay never sees them.

Direct.

Files move between client and device in both directions, encrypted end to end. No server can read them.

Locked.

Signed tokens bound to the client's certificate; paths are jailed.

Yours.

Your backend issues tokens; no hosted service, no accounts.

Same network, no relay

Finds the device on the LAN, no server needed.

Works offline

A ticket fetched earlier opens a session with no internet.

USB sticks and SD cards

Plugged-in media appear inside the share right away.

Built for device fleets and kiosks, field equipment, home servers, and any backend that wants file access to its devices without hosting a file service.

Filepunch does one thing: move files to and from a device. not a sync tool, a fleet dashboard, a VPN or a cloud service, so it fits beside what you already run.