A share code is convenient, but anyone who gets hold of it could connect. Adding a password gives you a second factor: even with the code, a recipient can’t receive the file without also knowing the password.
Steps
- Open Shafle, choose Send File, and add your file (or several — they zip into one).
- Turn on Password-protect this share and type a password.
- Send the recipient the code or QR as normal — and give them the password through a separate channel (say it out loud, or send it in a different app).
- When they enter the code, Shafle prompts them for the password. Once it’s correct, the transfer begins.
Is the password checked before the file is sent?
Yes — and this is the important part. Shafle verifies the password before any file data leaves your device. It never sends the file and then asks. Technically, your browser sends a random challenge, the recipient’s browser answers with a proof derived from the password, and your browser only starts the transfer if the proof checks out. The plaintext password itself is never sent across the connection.
Because the check happens up front, a wrong password simply means the transfer never starts. After three incorrect attempts the transfer is cancelled. The connection itself is also already encrypted end-to-end (WebRTC), so the password is an access layer on top of that.
Tips
- Send the password through a different channel than the code — not in the same message.
- Use a password you can say quickly if you’re sharing in person.
- Password protection applies to file transfers. For one-time text, use burn-after-reading instead.
Want the bigger security picture? See is P2P file sharing safe?