Is LocalSend Safe? The Honest Answer, and the Caveats That Matter

Someone recommended LocalSend, or it came top of a search for an AirDrop replacement, and now you are being asked to install an app that listens on your network and accepts files from other machines. That is a fair thing to pause over. The short version is that LocalSend is a well built open-source project and it is safe for ordinary use, and the caveats worth knowing are about you and your Wi-Fi rather than about the app.

LocalSend is safe for everyday use on a network you trust

Four properties do the work here, and each one removes a specific way that a file transfer tool can go wrong. It is worth knowing what each buys you rather than taking the words on trust.

• LocalSend publishes its complete source code under the Apache 2.0 licence, so nothing about its behaviour has to be taken on faith. The whole project sits on GitHub, where anyone who can read code can check what it connects to and what it sends.
• A file sent with LocalSend travels straight from one device to the other across your own network, so no company ever holds a copy. There is no upload and no download, which means there is no service that could later be broken into or sold.
• LocalSend encrypts every transfer with HTTPS, using a certificate each device generates for itself. Another machine sitting on the same Wi-Fi and watching the traffic go past would see scrambled data rather than your photos.
• LocalSend asks for no account, no email address and no sign-in of any kind. Nothing about you is registered anywhere, so there is no login to be leaked and no profile tied to what you send.
• LocalSend keeps working with the internet unplugged, because a transfer only ever uses the local network. All it needs is the Wi-Fi both devices are joined to, so a broadband outage or a hotel login that has expired does not stop a transfer.

None of that makes LocalSend risk free, and the parts that are genuinely on you are spelled out further down this page.

Camera to Clipboard ends in a paste and LocalSend ends in a file

Camera to Clipboard is our own app, and it is not a LocalSend competitor, so it is worth being clear about where the line falls before the rest of this page. LocalSend sends a file to a folder. Camera to Clipboard sends a photo to the computer's clipboard. Those are different jobs, and most people who need one do not need the other.

• Camera to Clipboard puts a phone photo onto the computer's clipboard instead of into a folder. Press Ctrl + V or Cmd + V in the email or document you already have open, and there is nothing left in Downloads afterwards.
• LocalSend leaves you holding a file, which is exactly right when the thing you want is a file to keep. Archiving a folder of photos, moving a video across, handing someone a PDF: use LocalSend for all of it and do not think twice.
• Camera to Clipboard carries the photo over your own Wi-Fi, with nothing uploaded to a cloud service. Like LocalSend, it keeps working on a router with no internet or on a phone hotspot.
• Camera to Clipboard is paired once by scanning a QR code and needs no account or email address. After that the phone and the computer recognise each other, so sending a photo is two taps.
• Camera to Clipboard's source code is not published, so nobody outside can read it the way anyone can read LocalSend's. Saying otherwise on a page about open source would be dishonest. What it does instead is keep the transfer on your own network so there is no cloud copy to worry about.

Open source means anyone can read LocalSend's code and check it

"It's open source" is the phrase people repeat most often about LocalSend, usually without saying what it buys. Here is what it does and does not cover.

• Published source code means a claim like "LocalSend uploads nothing" can be checked rather than believed. The part of the program that opens network connections is right there to read, and so is every address it is capable of contacting.
• Hiding a secret upload inside LocalSend would be very hard to get away with. Anyone can read the same source you can, and anyone can watch what a program on their network talks to from the router. Two separate ways of catching it are why the promise does not have to be taken on trust.
• Open source does not mean LocalSend has been audited by paid security professionals. Published code invites scrutiny, but it cannot guarantee it, and the honest position is that availability and inspection are different things.
• A closed-source transfer app can be judged only from the outside, by what its vendor says and what its traffic shows. That is not the same as it being unsafe, and plenty of closed products are trustworthy. It just means one way of checking is closed to you.
• An open-source project like LocalSend can be forked and carried on by other people if the current maintainers walk away. The code cannot be withdrawn, which is why an abandoned open project is a smaller problem than an abandoned commercial one.

LocalSend files never leave your network, so no company holds them

"Local only" is the other phrase that gets repeated. It is the strongest thing about LocalSend's safety, and it is also the source of its main limitation, so both halves are worth spelling out.

• A file sent through LocalSend crosses your own Wi-Fi from one device to the other and stops there. The two devices talk to each other directly, so nothing is staged on a server on the way past.
• Because LocalSend uses no server, there is no stored copy of your files anywhere that a future breach could expose. Cloud transfer services keep your file at least briefly, and anything kept is something that can leak.
• LocalSend still transfers normally when your router has no internet connection at all. An app that quietly uploaded your files would fail in that situation, so this is a test you can run yourself in about a minute.
• LocalSend never leaves the local network, so it cannot send anything to a device in another building. That is a real limit rather than a flaw, and it is the main reason people end up looking at other tools.
• Hotel, campus and office Wi-Fi that keeps devices apart will stop LocalSend seeing the other device. The setting is called client isolation and it defeats every local transfer tool equally. Turning on the phone's hotspot and joining the computer to it gives the two devices a small private network instead.

The real LocalSend risk is who else is on the same Wi-Fi

This is the part that matters, and it is not about the internet at all. LocalSend has to make your device findable before anything can be sent to it, and on a network full of strangers that changes what "findable" means.

• LocalSend announces your device on the local network, so anyone else running LocalSend on that Wi-Fi can see it listed. That is how the two ends find each other without you typing an address, and there is no way to have discovery without it.
• The device name you choose in LocalSend is shown to everyone else on the network, so it is worth not making it your full name. On a shared network that name is the only thing strangers learn, and a first name or a nickname tells them nothing useful.
• Quick Save in LocalSend accepts an incoming file without asking, and it should stay off on any network you do not control. With it on, someone else on the same hotel Wi-Fi can drop a file into your downloads folder without you touching anything.
• With Quick Save off, a LocalSend transfer from a stranger cannot land at all until you tap Accept on the prompt. That prompt is the whole defence on an untrusted network, and it is how the app behaves until somebody switches Quick Save on.
• LocalSend can ask for a PIN before it accepts a file, which is worth switching on for a laptop that lives on office or campus Wi-Fi. It matters most on a machine you leave running, where you might not be watching when a request arrives.
• Nothing in LocalSend exposes your device to the wider internet, so the question is only ever who else is on your Wi-Fi. The app listens on the local network and no further, which is why a home network with people you know needs none of the care above.

Install LocalSend from the project's own site or an app store

If there is one genuine danger on this page, it is this one, and it has nothing to do with the code being open. A popular name attracts imitators, and a download page is much easier to fake than a software project.

• The genuine LocalSend comes from localsend.org, from the project's GitHub releases, or from the stores those two link to. The project publishes through the App Store, Google Play, F-Droid, Homebrew, Flathub, winget and several Linux package managers, and every one of those is a channel where the publisher is checked.
• A well known open-source name like LocalSend is an obvious target for a fake build, because anyone can compile a modified copy and give it the same name and logo. The published source is not the weakness. A download site you reached from an advert is.
• LocalSend has no automatic updater, which is exactly why the project tells you to install it through a store or a package manager. Those channels bring you the new version on their own, so you are never tempted to go hunting for an installer later.
• Checking that a LocalSend installer came from the project rather than a download aggregator takes about ten seconds and removes the only serious risk in installing it. Look at the address bar before you click, not after the file is on your disk.

A firewall prompt on LocalSend's first run is normal, not malware

Plenty of people arrive at this question because Windows or macOS threw a warning the moment they opened the app. That warning is the operating system doing its job, and here is what each one means.

• Windows asking whether to allow LocalSend through the firewall on first run is expected, because an app that receives files must listen for incoming connections. A transfer tool that never triggered that prompt would have no way to be sent anything.
• When the Windows firewall asks about LocalSend, tick private networks and leave the public networks box unticked. That keeps it working at home and quiet on the coffee shop Wi-Fi your laptop joins later.
• The macOS prompt asking whether LocalSend may accept incoming network connections is the same question under a different name. Allowing it is what lets other devices see the Mac in the app's list.
• A Windows SmartScreen warning on a LocalSend installer is about how often Windows has seen that exact file before, not about anything found inside it. Installing through winget or another checked channel avoids the question entirely.
• Blocking LocalSend at the firewall usually leaves it able to send but not to receive, and often stops the other device listing it at all. If a transfer works in one direction only, the firewall answer you gave earlier is the first thing to revisit.

LocalSend publishes its code and Blip asks you to trust a company

Blip is the tool people most often weigh up against LocalSend, and the two are genuinely different in kind rather than in polish. Both are worth using. What separates them is what you are being asked to trust and how far a transfer can travel.

• Blip is a commercial product whose source code is not published, so its security can be judged only from the outside. That is the normal situation for commercial software and it is not an accusation. It does mean the code check described above is not available to you.
• LocalSend is a community open-source project released under the Apache 2.0 licence with its full source on GitHub. Anyone can read it, build it, fork it or point out a problem in public, which is a different kind of accountability from a vendor's assurance.
• Blip asks for an email address and a verification code during setup, while LocalSend asks for nothing at all. An address links your devices to an identity that the company then holds, which is worth knowing even if you consider the company entirely reputable.
• Blip can send between two devices that are nowhere near each other, which LocalSend simply cannot do. If you regularly send files to a machine in another city, that is a real advantage and it is the honest reason to pick Blip.
• Blip says a transfer runs directly between the two devices and only passes through its own servers when a direct connection cannot be made. LocalSend has no such fallback because it never leaves your Wi-Fi in the first place, which is the safety trade in one sentence.
• Blip runs on Windows, macOS, Android and iOS, with a Linux version still in development, while LocalSend already covers Linux. For a household with a Linux machine in it, that decides the question on its own.
• Blip is free for personal use and sells a licence to organisations, while LocalSend is free for everybody with nothing to buy. Neither model is suspicious, but they answer the question "how does this stay alive" in different ways.

If your main concern is safety in the sense of being able to verify what an app does, LocalSend wins that comparison plainly, because Blip cannot be checked the same way. If your main concern is sending a file to someone in another city, LocalSend cannot do it and Blip can.

LocalSend is the only tool here with code anyone can read

These are the four questions worth asking of any transfer tool before you install it, applied to LocalSend and the three things people most often compare it with.

Use LocalSend for any file and Camera to Clipboard for photos

Nothing on this page is a reason to avoid LocalSend. The choice is about which job you are doing, so find yours below.

• LocalSend is the right tool for sending files of any kind between your own devices on your own network, and there is no reason to hesitate. Install it on both ends, keep it, and stop looking. It does that job better than anything that involves a browser tab or a cloud account.
• LocalSend is still fine on hotel or office Wi-Fi as long as Quick Save is off and you accept each transfer yourself. That one setting is the difference between a network of strangers being irrelevant and being able to reach your downloads folder.
• Blip is the better pick when the two devices are not in the same place, because LocalSend cannot cross networks at all. You are trading a code check you can run yourself for reach, which is a reasonable trade if reach is what you need.
• Camera to Clipboard is the better pick when phone photos go into documents, emails and chats all day. Finding the downloaded file is the step you would otherwise repeat dozens of times a week, and pasting removes it.
• Downloading LocalSend from a search result or an advert instead of the project is the one thing that would genuinely make LocalSend unsafe. Everything else on this page is a setting. This one is a different program wearing the same name.

Common questions about whether LocalSend is safe

Is LocalSend safe to use?
Yes, for everyday transfers on a network you trust. The source code is published for anyone to read, and files go straight from one device to the other across your own network instead of through a company's servers. Every transfer is encrypted with HTTPS, and no account is needed. The parts that need care are yours rather than the app's: install it from the project or an app store, and leave Quick Save switched off on Wi-Fi you do not control.

Can other people on the same Wi-Fi see my LocalSend device?
Yes. LocalSend finds other devices by announcing itself on the local network, so anyone else running LocalSend on that same network can see your device listed under the name you gave it. On your own home network that is exactly what you want. On hotel, campus or office Wi-Fi, switch Quick Save off so nothing can be saved without you accepting it, and give the device a name that is not your full name.

Is LocalSend a virus, and why does my firewall warn about it?
LocalSend is not a virus, and a firewall prompt the first time it runs is expected. An app that receives files has to listen for incoming connections, which is exactly what the firewall asks you about. Allow it on private networks and leave the public networks box unticked. The genuine risk is a copy downloaded from a look-alike site rather than from localsend.org, the project's GitHub releases or an app store.

Is LocalSend or Blip safer?
They ask for different kinds of trust. LocalSend publishes its source code, needs no account, and never sends anything beyond your local network. Blip is a closed-source commercial product that asks for an email address during setup. It can also send between devices that are nowhere near each other, so a Blip transfer can travel across the internet rather than staying on your Wi-Fi. If being able to check the code yourself is what you mean by safe, LocalSend is the one to pick.