Free
- Pair any two browsers by QR code
- Text, Solana addresses and files up to 2 MB
- 10-minute sessions, 8 MB relayed per session
- Five-emoji verify code
- No account, no wallet
01
A private bridge between your own two screens.
ZPair moves a piece of text, a wallet address or a small file between a phone and a computer — no account, no cloud drive, no messenger, and a server that can't read what passes through it. Scan, compare five emoji, send. The session disappears after 10 minutes.
- Wallet addresses off your phone without emailing them to yourself — and checked as a valid Solana key on both screens.
- Photos and PDFs to your laptop without them landing in a chat history.
- A shared or public computer: send something to your phone and walk away; the link dies on its own.
- No sign-up. A wallet is only needed for the optional premium unlock.
02
What you're looking at.
Desktop and phone
A green dot means that device is connected to the relay right now. The screen turns blue when a phone has joined, lime once you confirmed the verify code.
The black box is the relay
Each row is the first bytes of a real frame's ciphertext — literally what the relay receives. It never gets anything readable.
Blue packets = encrypted frames
One per frame that crosses, in the direction it travels. The label is the start of its ciphertext; bigger frames draw wider.
Lime “KEY” = handshake
The phone's one-time public key on its way to the desktop. Public keys aren't secret; the pairing secret never crosses the wire.
The arc = time left
The link's remaining lifetime (10 minutes free). It turns red near the end; at zero the relay deletes the link and everything queued in it.
┆
Bottom strip = session timeline
The link's whole lifetime from left to right, with a cursor at “now”. Each tick is a real frame — up for desktop → phone, down for phone → desktop, taller for bigger frames.
03
How it works.
A one-time key in the QR
Your desktop makes an X25519 key pair and a 32-byte secret, and puts both after the “#” in the QR's link. Browsers never send that part to servers, so the relay only learns a random link id.
Scan
Your phone opens the link, removes the key from the address bar, makes its own key pair and sends its public half plus a confirmation value.
Derive and confirm
Both sides run X25519 then HKDF-SHA-256, salted with the secret from the QR. The desktop checks the phone's confirmation; a device without the secret is turned away.
Compare five emoji
Both screens show the same five emoji, derived from the shared keys. If they match, the phone you hold is the one on the line.
Send, then vanish
Text, addresses and file chunks travel as AES-256-GCM frames with numbered IVs. The relay keeps them in memory until the other side acknowledges, and deletes the link after 10 minutes or when either side ends it.
Limits, plainly: files up to 2 MB and 8 MB per session on the free plan; a link serves exactly one phone; if either browser closes, frames wait in the relay's memory until it reconnects or the link expires. ZPair uses no Solana RPC at all for pairing — the only on-chain step is the optional burn.
04
Built with.
- WebCrypto X25519 · HKDF-SHA-256 · AES-256-GCM. Private keys are created non-extractable.
- In-browser QR encoder — the key never goes to a QR-image service.
- Memory-only relay — Server-Sent Events down, small POSTs up, acknowledgements and back-pressure, no disk writes.
- Counter IVs — frames are numbered, so replays and gaps are detected, not silently accepted.
- Zero-dependency Node server with a strict per-request-nonce CSP and token-bucket rate limits.
- Canvas bridge drawn from live frames; pauses when hidden, slows to 1 fps under reduced motion.
05
Free, with a premium unlock.
Unlock with the coin
25,000 tokens burned · 30 days · stacks
- Remembered devices — reconnect a phone without scanning (up to 8)
- Files up to 25 MB, 120 MB per session
- 60-minute sessions
Sign in on the desktop with the wallet that burned; sessions it opens get the premium limits. The phone never needs a wallet.
Checking…
Burning destroys tokens permanently. It does not give you any return, revenue share or financial right. The free version of this app stays free.
06
The coin: burned to unlock, nothing more.
In ZPair, the coin does one thing. You burn it from your own wallet in a transaction you sign, and the server reads that burn back from Solana before switching premium on for 30 days. The SPL Token program destroys the tokens — nobody receives them. The coin is coming soon; until then the burn shows “Coming soon”.
Burning destroys tokens permanently. It gives no return, revenue share or financial right. The free version stays free.
Burn ledger
Public, verifiable on-chain.07
What the relay can see — and what it can't.
Can see
- A random link id and when it was opened
- The size and timing of each encrypted frame
- Both devices' IP addresses while connected — held only in in-memory rate limiters, never logged or stored
- For remembered devices (premium): a pair id, the wallet that unlocked it, and a hash of a channel token
Cannot see
- The key and secret in the QR code (the “#” part never reaches it)
- Any text, address, file content or file name you send
- The verify emoji or any session key
- Your wallet's secret key or seed phrase — never asked for
Trust model
You trust the page this server sends — as with any web app, the code that does the encryption comes from here. Given that code, the relay can delay or drop frames (numbered frames make that visible) but cannot read or change them.
The emoji protect against a photographed QR. If someone else scans your code first, your own phone is refused (“already scanned”) and the desktop shows a device you don't hold — end the session.
Nothing is stored. Frames live in memory until delivered and are deleted with the link. Only burn records, sign-in sessions and premium pair records touch disk. ZPair is not anonymity software.
Abuse: the person receiving can press “Report & end” — the link is closed at once and its id plus the reason are recorded for the operator (there is no content to keep). Size caps, rate limits and expiry apply to everyone. Sending illegal material is forbidden by the terms below.
08
FAQ.
Does the server keep what I send?
No. Frames are ciphertext held in memory until the other device acknowledges them, then dropped. When the link ends — after 10 minutes, or when either side presses End — anything still queued is deleted.
Why compare emoji if the key is in the QR?
The QR protects against the relay. The emoji protect against a person who photographs your screen and connects before your phone does. If the two screens show the same five, the phone you're holding is the one on the line.
Do I need a wallet or an account?
No. Pairing and sending need no account and no wallet (the relay still sees IP addresses while you're connected, as any website does). A wallet is only used to sign in for the optional premium unlock.
Which browsers work?
Current Chrome, Edge, Firefox and Safari on desktop and mobile — they need X25519 in WebCrypto. Any phone camera that opens links from QR codes can do the scan.
How big can files be?
2 MB per file and 8 MB per session on the free plan; 25 MB per file and 120 MB per session with premium. Files are encrypted in 192 KB chunks and reassembled on the other screen.
Can it pair two phones, or two computers?
Yes. “Desktop” just means the screen that shows the code; any browser can scan it.
What happens when I burn?
The server builds an unsigned transaction containing one SPL burnChecked for the amount shown plus a memo. You review and sign it in your wallet; the server reads it back from the chain and extends your unlock by 30 days.