SafeDrop — Android Dev Bridge

SafeDrop connects an Android device and a Windows PC over a trusted local network (LAN) for a small set of focused development / daily-use workflows — not a general-purpose file-transfer app.

To use SafeDrop, you need both components: download the Android APK and Windows server ZIP from the v0.6.0 release. Use them together on a trusted LAN, and follow the Quick start below to set up and connect both sides.

What it does

Three pillars, all over plain LAN HTTP:

• PC → Android: APK distribution — install a PC-built APK on your phone from a browser, without USB/adb.
• PC ↔ Android: Text Inbox — relay short text (IP addresses, URLs, command fragments, notes) between PC and Android clipboards.
• Android → PC: screenshot / file sharing — send a screenshot or file from Android's share menu straight into a folder on the PC.

Requirements

Windows side

• Windows 10/11
• Node.js 20 or later (tested on Node.js 24; the server only uses built-in Node.js modules — http, https, fs, path, os, crypto — plus async/await, fs.promises, and Promise.all, all of which are well-supported from Node 20 onward. No npm dependencies, no package.json needed to run it.)
• Same LAN (or otherwise trusted local network) as the Android device

Android side

• Android 8.0 (API 26) or later, target/compile SDK 36
• "Install unknown apps" permission for the browser used to download the APK (Android will prompt for this on first APK install from SafeDrop)

Quick start

1. Download both release assets

From the GitHub Release page, download:

• safedrop-vX.Y.Z-android.apk — the Android app
• safedrop-vX.Y.Z-windows-server.zip — the Windows server

You do not need SafeDrop already running to get the APK — both files come directly from the GitHub Release, independently of each other.

2. Set up the Windows server

Extract safedrop-vX.Y.Z-windows-server.zip to a folder of your choice, e.g. C:\SafeDrop\. That folder contains:

server.js
receiver.config.sample.json
scripts\start-server.ps1
scripts\stop-server.ps1
scripts\health-check.ps1
README.md
LICENSE

3. Configure receiver.config.json

From inside the extracted folder:

Copy-Item receiver.config.sample.json receiver.config.json
notepad receiver.config.json

Edit at least:

• token — replace the placeholder with your own random token (see "Generating a token" below)
• receiveDir — where received screenshots/files are saved (default received, created automatically)

Leave apps.enabled and https.enabled as false unless you specifically need them (see "Workflow details" further down for what they do).

Generating a token

Any sufficiently random string works. One way, using PowerShell only (no extra tools):

-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 24 | ForEach-Object { [char]$_ })

Paste the result into token in receiver.config.json.

4. Start the server

powershell -File scripts\start-server.ps1

This starts node server.js in the background and is safe to re-run — it checks /ping first and will not start a second instance if one is already running. To run it in the foreground instead (useful for the first run, so you can see the startup banner):

node server.js

Ctrl+C stops a foreground server. If Windows Firewall prompts on first start, allow access on private networks.

5. Verify the server

powershell -File scripts\health-check.ps1

This is read-only and checks /ping (no token needed) plus a couple of token-gated routes using the token from your local receiver.config.json. Exit code reflects whether /ping succeeded.

6. Install the Android APK

On the Android device, transfer safedrop-vX.Y.Z-android.apk (e.g. via the GitHub Release page in a mobile browser, or any other means you already have), open it, and allow installation from that source when prompted.

7. Add the Android profile

Open the SafeDrop app, go to its PC connection settings, and enter:

• PC address — <PC-LAN-IP>:8787 (no http://), e.g. 192.168.1.10:8787
• Token — the same token you set in receiver.config.json

Find your PC's LAN IP with ipconfig (look for the IPv4 address on your Wi-Fi/Ethernet adapter). The server also prints its LAN addresses in its startup banner.

8. Verify the first connection

In the app's connection settings, tap 接続テスト (Test connection). A successful result confirms the Android device can reach the PC server with the configured token. You can also open http://<PC-LAN-IP>:8787/?token=<token> in the Android browser — it should show the SafeDrop launcher page.

Main workflows

APK distribution

Point apk.path in receiver.config.json at a built APK (or list multiple APKs under apk.items). Then, from the Android browser:

http://<PC-LAN-IP>:8787/apks.html?token=<token>

Pick an entry, download, install.

Text Inbox

• PC browser (send): http://127.0.0.1:8787/text-send?token=<token>
• Android browser (receive/copy): http://<PC-LAN-IP>:8787/text?token=<token>

Keeps the last 10 entries; each can be copied, reloaded into the send form, or deleted individually.

Screenshot / file share (Android → PC)

From Android's share menu, choose SafeDrop, pick a profile (e.g. Screenshots), and send. Files land under received/<profile>/YYYY-MM-DD/<filename> on the PC (or without the date folder, depending on the profile's dateSubdir setting).

Security / network model

• Trusted LAN only. SafeDrop is built for a home/trusted local network. Do not expose it directly to the public Internet (no port forwarding, no reverse proxy to a public address).
• Plain HTTP by default. Traffic is unencrypted unless you explicitly enable and configure https in receiver.config.json (see the HTTPS section in "Workflow details" in the repository README if you need it — it requires generating your own local certificate).
• Token-protected, not identity-protected. The token is a shared secret that prevents accidental/unrelated LAN traffic from reaching the server; it is not a substitute for running on an untrusted network.
• No telemetry, no analytics. The server does not phone home; it only serves the LAN.
• Never commit or share: receiver.config.json, your token, your real LAN IP, text-inbox.json, or anything under received/.

Updating

Android: download the newer signed APK from a later GitHub Release and install it over the existing com.iwadjp.safedrop install (same package ID). There is no in-app auto-update and no data migration step needed — app settings persist across a normal install-over-install upgrade.

Windows server: back up your local receiver.config.json (and received/ if you want to keep past transfers), extract the new server zip over the old files (or into a fresh folder and copy your config back in), then restart with scripts\start-server.ps1. receiver.config.json and runtime data (text-inbox.json, received/, logs/) are never part of the distributed zip, so a normal extract-over-extract will not overwrite them as long as you keep them in the same server folder.

Troubleshooting

Symptom	Likely check
Server does not start	Run node server.js in the foreground and read the error. Confirm Node.js 20+ is installed (node -v).
"Port already in use" message on startup	Another SafeDrop (or other) process is already using the port. Run scripts\health-check.ps1 — if /ping is OK, a server is already running. Otherwise stop the conflicting process or start with --port <other-port>.
Android app can't connect	Confirm PC and Android are on the same LAN/subnet, confirm the PC address entered in the app (IP:port, no http://), and confirm Windows Firewall allowed the server on private networks.
401 / "invalid token"	Token mismatch between receiver.config.json and the Android app (or the URL you opened). Re-check both, tokens are case-sensitive.
Can't reach the server from Android at all	Check Windows Firewall, and confirm the PC and phone are not on isolated/guest Wi-Fi (some routers block device-to-device traffic on guest networks).
APK list is empty	apk.items is empty and apk.path doesn't point to an existing file — this is expected on a fresh config until you point it at a real APK.
A Hub app-card shows "source not available"	The configured apps.items entry's source path isn't currently reachable; the launcher marks it unavailable quickly rather than hanging, so this is a normal, fast response — not an error.

Development / tests

node --check pc-server\server.js
node --test pc-server\test\server.test.js

License

MIT — see LICENSE.