Notes about security

HTTP File Server is designed primarily for use on trusted networks, such as a home WiFi or your phone's hotspot. You should use at least WPA2 or ideally WPA3 to encrypt connections in your network.

The rest of this page contains information about some of the options you can enable to make HTTP File Server itself more secure.

Most importantly, it is up to *YOU* to weigh the risks of using this application. WE STRONGLY DISCOURAGE USING IT ON PUBLIC NETWORKS, UNSECURED NETWORKS OR ANY NETWORKS WHERE YOU DON'T KNOW WHO MAY BE CONNECTED. WE ARE NOT RESPONSIBLE FOR ANY DATA STOLEN, LOST OR DAMAGED AS A RESULT OF USING THIS APPLICATION.

HTTPS

We offer HTTPS encryption with a self-signed certificate. This makes it not possible for an attacker to see your traffic by just listening but it is still vulnerable to man-in-the-middle attacks. Because the certificate is not signed by a trusted authority, your web browser will complain (rightly so) that it cannot verify the server's identity. To verify the connection yourself, you can display the SHA fingerprints of the certificate in the application and compare it with what the browser has received.

Authentication

HTTP File Server implements basic authentication. This involves sending the password in clear text, so it only makes sense when used together with HTTPS.

Connection confirmation

When enabled, you will be asked every time a new IP address tries to connect to the server to allow or deny the connection. Your choice will be remembered until the application is closed. Please be aware that this can still be bypassed by IP spoofing.