Questions people ask before they trust this
Short answers, including the unflattering ones. If something here turns out to be wrong, it is a bug in this page and worth reporting.
1. Is it really encrypted?
Yes, and not as a setting that can be turned off. Everything between two people travels over a WebRTC DataChannel, which is DTLS-encrypted or does not exist at all. Voice and screen sharing ride the same connection over SRTP.
What matters more than the word "encrypted" is who holds the keys. The keys are negotiated between the two browsers; the server relays the handshake and never sees them. To prove there is nobody in the middle, each person has five safety words beside their name: read them aloud, and if they match, the connection is between you two and nobody else.
When you join from an invite link, that check also happens automatically: the link carries a secret the server has never seen, and each side proves it holds it. That is what the green "verified" badge means.
On top of that, everything is encrypted a second time with keys a future quantum computer cannot recover: a hybrid of X25519 and ML-KEM-768, mixed with the room’s secret when there is one, with keys that change at least every minute and a fresh exchange every half hour. Somebody recording your traffic today to open it in ten years gets nothing. Messages and files always get this layer; calls and screens get it where both browsers can seal video and audio frames, which the connection panel tells you person by person.
2. Where are my files stored?
Nowhere. There is no storage to put them in: the file goes from one browser to the other and is written straight to the disk of whoever accepted it. The server passes the two browsers enough information to find each other and nothing else.
That is also why we set no size limit (Chrome and Edge write a file straight to disk; other browsers hold up to 512 MB in memory), no expiry date and no download link. A link to a file would mean a file sitting somewhere, and there is not one.
3. My friend cannot connect. What now?
First: both of you need the page open at the same time. There is nothing stored, so there is nothing to collect later.
If the room shows them as "connecting" for more than a minute, the two networks are refusing a direct connection - usually a strict router or a mobile carrier. Turn on "Hide my IP" in the room’s connection panel if this deployment has a relay configured: it routes through the relay instead, which almost always gets through.
A company or school network that blocks UDP outright can stop it entirely. That is not something this application can work around, and it will say so rather than spin.
4. What are the five words beside a name?
They are a fingerprint of the encryption keys, turned into words so a human can compare them. If your five words and their five words are the same, nothing is sitting between you rewriting the conversation.
It is the same idea as the safety number in Signal. Checking it takes ten seconds and is the only part of this app that asks anything of you.
Side by side, you can scan each other’s code instead: open the safety number and press "Scan their code". In a call, a shield beside each person says whether they were verified - worth a look, because a voice can now be imitated convincingly.
5. Is the file checked for malware?
It is examined, which is not the same as scanned by an antivirus, and the wording in the app is careful about the difference. There is no malware database in a web page.
What happens is triage: the real file type against the name it is wearing, double extensions and hidden characters, programs buried inside documents or images, macros, scripted PDFs, archive contents, code signatures. The sender sees that report before anything is sent, and the person receiving sees it - plus their own check of the first few kilobytes - before accepting. The whole file is checked again on arrival, and every 4 MB block is verified with SHA-256 as it lands.
The best score it can give is 95 out of 95, and it says outright that "nothing was found" is not "this is safe".
6. Can someone send me a file without my agreement?
No. A file offer is a question with two buttons, and nothing is written to your disk until you press Accept - which is also the click that gives the browser permission to choose where it goes.
The same rule covers the microphone: audio from a call that you have not joined is held, unplayed, and the room simply tells you people are talking. Your microphone is not opened until you join the call yourself.
7. What does Burn actually erase?
It disconnects everyone at once, makes the code stop working, and on every machine in the room it clears the page’s memory, the browser storage, the resume notes and the offline copy of the application itself.
What it cannot do is reach a file somebody already saved to their disk, or a screenshot they took. Nothing can. The app says so in those words rather than implying otherwise.
8. How do I get out fast if somebody walks in?
Press Escape three times within a second. The page goes blank at once, you leave the room - if you are the host, the room burns for everyone - and this browser forgets Obleevo: its memory, its storage and its offline copy. The tab ends on an empty page, and Back does not bring the room back.
On a phone without a keyboard, use Leave, or Burn if you are the host.
9. Do my photos give away where I am?
Not the JPEG, PNG and WebP pictures you send through Obleevo: before they leave, your browser removes the GPS position, camera details, embedded text and anything attached after the image, and the send dialog says what it took out. The picture itself is not touched.
Formats it cannot clean safely - HEIC photos from an iPhone, videos, raw files - go out as they are, and the dialog warns you. Convert them first if where they were taken matters.
10. Can the other people see my IP address?
In a direct connection, yes - that is what "direct" means, and it is true of every peer-to-peer tool including the ones that do not mention it. Obleevo says so on the connection panel instead of hiding it.
If this deployment has a relay configured, "Hide my IP" routes your connection through it: the others then see the relay and never your address. It costs some speed, and the relay operator sees traffic volumes rather than contents - the encryption is end to end either way.
11. How big a file can I send?
There is no limit imposed by this application. Sending 20 GB has been tested end to end; the file is read in 4 MB blocks and written straight to disk, so neither side ever holds it in memory.
Two practical limits are worth knowing. Streaming to disk needs Chrome or Edge on a desktop; other browsers hold the file in memory and are capped for that reason, and the app says so before you send rather than after. And a transfer needs both tabs open - close one and it pauses, to be resumed later from where it stopped.
12. Does sending to several people cost me several uploads?
No. The people receiving trade the pieces between themselves, so the file leaves your machine roughly once however many of them there are. Measured on the machine this was built on: 20 GB sent to two people uploaded 20 GB and delivered 40 GB.
If the others cannot reach each other, your machine quietly fills the gaps - the trading is the optimisation, and everybody getting the whole file is the guarantee.
13. Is it free, and what is the catch?
It is free to use and has no advertising, no accounts and no analytics. The catch, if it is one, is that it is not free software: it is proprietary, and the licence does not allow copying, modifying or hosting it elsewhere.
It costs very little to run precisely because it stores nothing - a room that moves a hundred gigabytes costs the server a few kilobytes of introductions.
14. Does it work on a phone?
Yes, in the browser, and it can be installed to the home screen like an app. On Android it also appears in the system share sheet, so a photo can be sent to a room straight from the gallery - the files are handed to the page by the offline worker and never uploaded anywhere.
The limit on a phone is where large files go: only Chrome and Edge on a desktop can stream a file straight to disk, so on a phone very large transfers are held in memory and capped. The app warns the sender before the file is offered.
Last reviewed:
About · Why this · Terms · Privacy · Accessibility · Cookies · What’s new
Obleevo is developed by The House of Brendrof. Proprietary software, free to use.