Is LocalSend safe? What its docs, code, and advisories show

LocalSend is open source, needs no account, and sends files over HTTPS directly between devices on your own network, with no LocalSend server in the middle. That is a sound design for a file-sharing app. It has also had serious security flaws: three advisories have been published, all for version 1.17.0 or earlier, and one of them let someone on the same Wi-Fi pose as your device. We found no independent security audit. So the fair answer is that LocalSend is reasonable to use on a network you trust, if you keep it updated to 1.18.2 or later. Nobody can promise more than that for any app, including this one.

Publisher note: The Relay publishes this guide and is one of the products discussed. Details about other products come from each maker's own pages, checked on 25 October 2026. Prices and features change, so confirm before you buy.

What does LocalSend say about its own security?

Two of its pages describe it a little differently.

The LocalSend website says: "End-to-end encryption ensures that only you and the recipient can access your files." Its FAQ answers "Is it secure?" with "All transfers are encrypted using HTTPS", and adds that you can turn on PIN verification.

The GitHub README is more specific. It says data is sent "securely over HTTPS" and that the security certificate is "generated on the fly on each device". There is no LocalSend server, and the app "doesn't require an internet connection or third-party servers".

The README's wording is the one to plan around. HTTPS between two devices protects the files while they cross your network. How much it protects you also depends on whether you are talking to the device you think you are, which is where the advisories below come in.

How does the encryption work?

The protocol documentation explains the parts that matter for safety:

• Each device has its own certificate. When encryption is on, a device's "fingerprint" is the SHA-256 hash of its certificate. The document says the fingerprint is used "to avoid self-discovery and to remember devices".
• Encryption can be switched off. With it off, the app uses plain HTTP and the fingerprint is a random string. The README's own tip for slow transfers is to "Disable encryption on both devices". That trades privacy for speed, so leave it on unless the network is yours.
• Share via link uses plain HTTP. This feature lets someone download files in a web browser instead of the app. The protocol page says it uses unencrypted HTTP "because browsers reject self-signed certificates". Treat it as unencrypted.
• PIN codes are optional. The changelog records options to require a PIN when receiving files and when sharing via link. That stops strangers on your network from sending you files or opening your shared link without it.
• The receiver approves. By default the sender offers a list of files and the receiver accepts or declines them.

What security flaws have been published?

LocalSend publishes advisories on its GitHub security page. There were three when we checked. The sources disagree in places, so both are shown.

Some details behind that table:

• The path traversal fix is listed in the v1.17.0 release notes as "path traversal vulnerability when saving files".
• The spoofing flaw is the serious one. The advisory says it works because the sender's address in a discovery message "can be trivially spoofed", and that it worked even for devices saved as favourites. GitHub rates it critical, at 9.3 on the CVSS 4.0 scale. The NVD record scores it 6.8, medium, on CVSS 3.1. The v1.17.0 release notes do not mention it, and the GitHub advisory names no fixed version, so we cannot tell you from the project's own pages which release closed it.
• The cross-site scripting patch is in this commit from 30 January 2026. GitHub's history shows it is included in v1.18.0, released on 10 August 2026.

The current release, v1.18.2 of 21 August 2026, adds one more security change: it no longer follows HTTP redirects sent by other devices.

Publishing advisories is a good sign in itself. It means flaws are reported, credited, and recorded in public. It does not mean every flaw has been found.

Has LocalSend been independently audited?

Not that we could find. The repository has no security policy file, and we found no published third-party audit of the app. Being open source means anyone can read the code, and the advisories above came from outside researchers doing exactly that. That is useful, but it is not the same as a paid, scoped audit with a report. If a security review is a hard requirement for you, LocalSend does not have one to show.

One assurance it does offer is for Windows. Its code signing policy says official Windows releases are built from the public source and signed through SignPath, with each signing manually approved. The policy covers Windows only.

Does LocalSend collect data?

Its privacy policy, last updated 8 May 2024, says the project does not "collect, store, process, or use" personal or non-personal data. The site adds "no ads, no tracking". The policy points out that operating systems, device makers, and other apps may collect data under their own policies. We cannot verify any of this independently. It is the project's statement.

How do I use LocalSend more safely?

1. Update to 1.18.2 or later, on every device. The README says the app does not update itself, so install it from the Mac App Store, Homebrew, Google Play, or F-Droid, which update for you. The DMG and APK from GitHub do not.
2. Use it on networks you trust, such as home Wi-Fi. The spoofing flaw needed an attacker on the same network. Public and hotel Wi-Fi are where that is most likely.
3. Leave encryption on. Do not take the README's speed tip on a network you do not control.
4. Turn on a PIN for receiving if other people share your network, so nobody can send you files without it.
5. Read the request before you accept. Check the sender's name and the file list. Be cautious with Quick Save, which accepts files without asking. Version 1.18.0 also made automatic acceptance from favourite devices the default, so review your favourites.
6. Avoid share via link for anything private. It is plain HTTP by design.

Where does The Relay fit?

The Relay, which publishes this guide, also keeps things on your own network. Your clipboard, files, texts, and notifications travel directly between your phone and your Mac over your local network. They are not uploaded to The Relay's servers, and the connection between the two devices is encrypted. There is no account or sign-up with The Relay. Unlike LocalSend, its code is not public, so you cannot read it the way you can read LocalSend's, and it is not free: The Relay is one subscription through Google Play that covers your phone and your Mac, with a 7-day free trial. It only fits if you want more than files, such as clipboard sync and login codes; see The Relay vs LocalSend. For sending files, LocalSend kept up to date is a reasonable free choice.

Questions people ask

Is LocalSend a virus or malware?

Its source code is public under the Apache License 2.0, and its maker publishes security advisories. Download it only from the sources its README lists: the Mac App Store, Homebrew, Google Play, F-Droid, or its GitHub releases page.

Can someone on my Wi-Fi see my LocalSend files?

Transfers are sent over HTTPS when encryption is on, which is the default. Two exceptions: share via link uses plain HTTP, and versions up to 1.17.0 had a published flaw that let someone on the network pose as your device. Update and keep encryption on.

Is LocalSend safe on public Wi-Fi?

It is less safe there, because the flaws published so far needed an attacker on the same network. Use the latest version, turn on a PIN, and save private transfers for a network you trust.

Does LocalSend collect my data?

Its privacy policy says it collects no personal or non-personal data, and its site says there is no tracking. That is the project's own statement; we have not audited it.

Has LocalSend had a security audit?

We found no published independent audit. Its security record consists of three public advisories, reported by outside researchers, for versions 1.17.0 and earlier.