Setu (सेतु = "bridge") connects your devices and people in seconds. Upload files via QR, create real-time rooms for chat & whiteboard — all protected by modern encryption. Here's the full story, in plain language.
Setu has two main screens. Each has a clear job — together they cover everything from quick file sharing to live collaboration.
The home page. Pick files or folders, optionally add a password, and generate a QR code + short link. Anyone with the code can scan and download — no login needed. Includes Quick Receive, Receive tab, and History.
The collaboration page. Login required. Create or join a room with an 8-character code, QR, or link. Inside: real-time chat (reply, edit, unsend), peer-to-peer file sharing, and a shared whiteboard.
From your browser to the server to your friend's phone — here's the full flow of how Setu moves files and messages securely.
Figure 1 — End-to-end flow of a file transfer on Setu. Your file never sits on the server in plain form.
Here's exactly what happens when you share a file on the home page (File Transfer Hub).
Open File Transfer Hub, drag files/folders into the upload area or click to browse. You can also pick an entire folder — it gets zipped in your browser.
Set an optional password and tick "One-Time Download" if you want the link to self-destruct after a single fetch. No password? Anyone with the code can still download.
Click "Generate QR Code". Your file is encrypted and uploaded in chunks. You get a QR code, a short code, and a shareable link.
Send the QR/link via WhatsApp, Email, or just show the QR. The receiver doesn't need a Setu account — they scan and land on the download page.
Receiver enters the code (or scans QR), enters the password if set, and downloads. A 7-minute countdown starts — after that, the link auto-expires. You can also expire it manually.
Rooms use WebSockets for instant, bidirectional communication. Here's how two (or more) people join the same room.
Figure 2 — Room connection. Every member opens a secure WebSocket to the server, which routes chat, files, and whiteboard updates to the right room.
A closer look at the mechanics behind the two pages.
The home page is built for one thing: move a file from you to someone else, fast, with as little friction as possible.
Drop files here or click
Max: 10GB per Upload
The room page is a live workspace. Login is required so the server knows who's who — every action is tied to your authenticated session.
Setu is built with security at every layer — encryption, authentication, and auto-expiry. Here's exactly what protects you.
Every file is encrypted with a fresh 256-bit AES key (CFB mode) before it ever leaves your device. The key is wrapped with AES-GCM using a server secret — the raw key is never stored.
Optional passwords are hashed with PBKDF2-HMAC-SHA256 over 100,000 iterations with a random salt. Verification uses constant-time comparison to prevent timing attacks.
Password-protected downloads require a verified ticket. The password is checked server-side, and only then is the wrapped key released for decryption.
Room access (setu.html) requires login. Appwrite issues a JWT that's verified on every API call and WebSocket connection — no anonymous room access.
All real-time chat, file, and whiteboard traffic flows over wss:// — TLS-encrypted in transit. The server relays signals; it doesn't read your messages.
QR transfers auto-delete after 7 minutes. One-time downloads expire after a single fetch. You can also manually expire a link — only the uploader holds the delete token.
Each connection gets a unique session ID. The server tracks active sessions per room, so member lists stay accurate and leaving a room cleanly clears your session.
Large files are split into encrypted chunks (max ~1.9GB each) before storage. No single piece is usable on its own — and the key lives separately from the chunks.
A quick summary of how each layer is protected.
* Scores reflect implemented protections. No system is 100% — always use strong passwords and share links only with trusted recipients.
Plain answers about where your files and profile information live.
Files are encrypted before upload and stored as encrypted chunks. The decryption key is wrapped and stored separately. Even if storage were compromised, the chunks are useless without the wrapped key and the server secret.
If you log in, your name, nickname, email, phone, and country are stored in the Setu database to power your profile card and room membership. This data is tied to your authenticated account — not shared publicly.
Chat messages in rooms are relayed over WebSocket to connected members in the room. They are not permanently stored — when you leave or the room closes, the live session ends.
QR file transfers auto-expire after 7 minutes. One-time downloads vanish after a single fetch. You can manually expire links anytime. History entries can be deleted from your History tab.
Share a file in seconds, or open a room and start collaborating. No installs, no friction.