Guides
How a browser-to-browser transfer works
The service arranges the meeting; content takes a separate path. Following the whole flow explains both its privacy properties and its connection failures.
The meeting starts with a code
When someone selects “Send something”, the first browser opens a WebSocket and the Worker creates a six-character code. A Durable Object holds the technical state for that Pase: participants, connections and activity times. A new anonymous Pase allows ten minutes for the second browser to arrive.
The same code is placed in a link and QR. Either device can create it; that choice does not determine which browser will send the file.
The second browser arrives
The other browser normalises the code and asks to join over its own WebSocket. Manual approval is disabled in the current configuration, so a valid request is approved automatically. A Pase holds the owner and one second participant; another join is rejected.
Only control messages are moving at this stage. The code does not open a history of texts or files waiting on the service.
The browsers negotiate a path
The Pase creator starts an RTCPeerConnection and an ordered DataChannel called “mandamele”. It sends an SDP offer over WebSocket; the second browser returns an answer, and both exchange ICE candidates. The Durable Object forwards these messages to the authorised identifier without turning them into transfer content.
Configuration uses Cloudflare's STUN service to discover connectivity options. There is no TURN server. If NAT, VPN, firewall or network policy blocks every possible route, negotiation fails rather than uploading the file to the service.
Content changes path
Send controls become available after both endpoints confirm that the DataChannel is open. Text is serialised on that channel. Each file begins with validated metadata and continues as ordered 64 KiB binary chunks.
The sender pauses when its buffer exceeds 1 MiB and continues as it falls towards the 512 KiB threshold. The receiver checks the expected size and creates a local Blob. Files exceeding the Pase limit are rejected before sending: 50 MB without an account, or 250 MB if either person signs in.
The session ends at the endpoints
The receiver can preview certain text or images and download the file. Those copies live in the browser or user’s system, not in a Mándamele inbox. Closing the Pase releases local object URLs managed by the interface, but it cannot remove a saved download.
While connected, the client sends a control ping every 25 seconds. An anonymous Pase closes after thirty minutes without activity and may end sooner when a tab closes or a participant leaves.