📖 Table of Contents
Project Overview
What is OffDrop?
OffDrop is a cross-platform, offline file distribution system designed for fast, secure file sharing over local networks. It combines high-speed file transfer capabilities with enterprise-grade AI-powered malware detection to ensure only safe files are distributed across your organization.
Key Capabilities
- 🚀 High-Speed Transfers: Direct peer-to-peer file sharing over Wi-Fi without internet
- 🛡️ Real-time Threat Detection: AI-powered malware analysis with 99.5% accuracy
- 🔐 Security Token System: QR code-based access control with IP binding
- 📱 Multi-Platform: Windows, macOS, Linux, Android, and iOS support
- 🎯 Universal Analysis: Detects threats across all file types
- 📊 Comprehensive Forensics: Detailed threat reports with evidence
Use Cases
- Enterprise software distribution without internet dependency
- Secure file sharing in restricted network environments
- Malware quarantine and analysis within isolated networks
- Educational institutions for secure file distribution
- Government and military networks requiring air-gapped security
✨ Why Use OffDrop?
The Problem It Solves
Traditional file sharing solutions rely on cloud storage and internet connectivity, creating security risks, privacy concerns, and bottlenecks. Organizations need a fast, private, and secure way to share files without uploading to external servers or waiting for internet connections.
OffDrop solves these challenges with local-only file transfer.
🚀 Ultra-Fast Speeds
Transfer files at gigabit speeds on local WiFi with no internet bottlenecks. Multi-GB files transfer instantly instead of hours.
🔒 Completely Private
Files stay on your local network and are never uploaded to any external server. All transfers are private and secure.
💾 No File Size Limits
Transfer multi-GB files instantly without worrying about upload limits. Your only constraint is available disk space.
🌐 No Internet Needed
Works offline on local WiFi or hotspots. Perfect for restricted networks, air-gapped systems, or areas with no connectivity.
📱 Cross-Platform
Transfer seamlessly between laptops, phones, tablets, and desktops. Windows, macOS, Linux, iOS, and Android all supported.
✅ No Accounts Required
No login, registration, or authentication overhead. Simply connect via QR code and start transferring files immediately.
🛡️ AI-Powered Security
Enterprise-grade threat detection with 99.5% accuracy. Malware, phishing, and suspicious files are automatically quarantined.
🔐 End-to-End Control
Host your own file hub with complete control. No third-party servers, no dependency on external services, complete data sovereignty.
🔄 How It Works
The Concept
OffDrop creates a local network hub where devices can connect and share files. One device acts as the host (server) and other devices connect to it as guests. All communication happens locally without any internet requirement.
Network Requirements
- ✓ Same WiFi Network: All devices must be on the same local WiFi network
- ✓ Mobile Hotspot Support: Devices on a mobile hotspot work too (the phone is the host)
- ✓ No Internet Required: No internet connection needed for transfers (but local network must be active)
- ✓ Offline Networks: Works perfectly on isolated networks not connected to the internet
Step-by-Step Process
Step 1: Start the Host (Device A)
- • Open OffDrop on your device (this becomes the host)
- • Choose Public Mode or Private Mode
- • A QR code appears on your screen
- • Keep this device running (it's the file hub)
Step 2: Connect Guest Devices (Device B, C, ...)
- • Open OffDrop on another device on the same WiFi
- • Option A: Scan the QR code shown on the host device
- • Option B: Copy and paste the connection link manually
- • You'll see a confirmation that you're connected
Step 3: Transfer Files
- • Upload: Go to Transfer tab, select your file, and click Upload
- • Progress: See real-time upload speed and percentage
- • Download: Other connected devices see your file in File History
- • Get Files: Click Download next to any file to save it
Step 4: Monitor Performance
- • Go to Performance tab to see connection quality
- • View current speed, last upload speed, and connection analysis
- • Understand your network's transfer capabilities
🎯 Connection Modes
👥 Public Mode (Many-to-Many)
Overview
Unlimited devices can connect and all devices can see and download all files.
Key Features
- ✓ Unlimited device connections
- ✓ All devices see all files
- ✓ Files shared across all sessions
- ✓ Anyone with QR code can join
Best For
- • Group file sharing
- • Office/team collaboration
- • Classroom distribution
- • Conference/event file sharing
🔒 Private Mode (One-to-One)
Overview
Only 2 devices can connect (host + 1 guest) with secure, encrypted transfer.
Key Features
- ✓ Exactly 2 devices only
- ✓ Secure encrypted link
- ✓ Files isolated to pair only
- ✓ Unique session tokens
Best For
- • Confidential transfers
- • Personal files
- • Contracts/legal documents
- • Medical/health records
💡 Tip: Multiple private sessions can run simultaneously with different pairs. Each pair's files are completely separate.
Pro Tip: Use Private Mode for sensitive transfers (contracts, medical records, personal data). Use Public Mode for collaborative team file sharing where everyone needs access to the same resources.
Core Features
🎯 AI-Powered Detection
MicroAI engine analyzing files with 5 forensic features for malware probability calculation
🔐 QR Token Auth
QR code-based security tokens with IP binding and 10-minute time-to-live
📄 PDF Detection
Specialized detection for 135+ PDF threat signatures with 99.5% accuracy
🌍 Universal Analysis
Cross-file-type threat pattern detection for executables, scripts, documents, and more
📋 Forensics Engine
Entropy calculation, magic number validation, and suspicious pattern matching
🛡️ Access Control
Origin validation, HTML access prevention, and security headers middleware
📱 Cross-Platform
Native support for Windows, macOS, Linux, Android, and iOS
🔒 Quarantine System
Automatic isolation of suspicious files with detailed analysis reports
System Architecture
Architecture Overview
┌─────────────────────────────────────────────────────────────┐
│ Frontend Layer │
│ (Web UI, Desktop Apps, Mobile Clients - Capacitor) │
└────────────────────────┬────────────────────────────────────┘
│
┌─────────────────────────┴────────────────────────────────────┐
│ Express.js Backend │
│ • File Upload/Download Management │
│ • Security Token Generation & Validation │
│ • QR Code Generation │
│ • API Endpoints │
└─────────────────────────┬────────────────────────────────────┘
│
┌─────────────────────────┴────────────────────────────────────┐
│ AI/ML Threat Detection Engine │
│ ├── MicroAI (ai.js) - Probability Calculation │
│ ├── Forensics (forensics.js) - Static Analysis │
│ ├── Model (model.js) - Report Generation │
│ ├── PDF Detector - Specialized Analysis │
│ └── Universal Analyzer - Cross-file Detection │
└─────────────────────────┬────────────────────────────────────┘
│
┌─────────────────────────┴────────────────────────────────────┐
│ File Storage & Quarantine │
│ • uploads/ - Uploaded files │
│ • uploads/quarantine/ - Suspicious files │
└─────────────────────────────────────────────────────────────┘
Backend Components
server.js
Express.js application server handling file transfers, authentication, and API endpoints
Ai-Model/ai.js
MicroAI engine calculating malware probability using weighted forensic features
Ai-Model/forensics.js
Static file analysis: entropy, signatures, patterns, imports
Ai-Model/pdf-advanced-detector.js
Specialized PDF threat detection with 135+ signatures
Ai-Model/universal-threat-analyzer.js
Cross-file-type threat pattern matching
Technology Stack
Backend
- • Node.js 18+
- • Express 4.18.4
- • Multer 1.4.5
- • QRCode 1.5.1
Frontend & Deployment
- • Electron 7.11.1
- • Capacitor 6.1.2
- • TailwindCSS 4.2.4
- • pkg (Binary Packaging)
Installation & Setup
System Requirements
- Node.js: 18.0 or higher
- RAM: Minimum 2GB (4GB recommended)
- Disk Space: 500MB for installation + space for uploads
- Network: Local Wi-Fi network connectivity
- OS: Windows 10+, macOS 10.13+, Linux (Ubuntu 18.04+)
Development Installation
1. Download the application
Download
Platform-Specific Installation
Windows
macOS
- Navigate to Mac_Version directory
- Make startup script executable: chmod +x start_application.command
- Double-click start_application.command
- Grant necessary permissions when prompted More Info
Linux
- Navigate to Linux_Version directory
- Make startup script executable: chmod +x Start_application.sh
- Run: ./Start_application.sh More Info
Usage Guide
Basic File Upload
- Launch the OffDrop application
- Click the "Upload File" button or drag files into the interface
- System automatically analyzes files for threats
- View analysis results and threat score
- Safe files are available for distribution
- Suspicious files are automatically quarantined
QR Code Authentication
OffDrop uses secure QR code tokens for access control:
- Generate unique QR code for each session
- QR codes are valid for 10 minutes
- Tokens are bound to client IP address
- Scan QR code from mobile device or another client
- Automatic token validation on file access
Threat Analysis Workflow
User Uploads File
↓
System Extracts Forensic Features
├── File Size Analysis
├── Entropy Calculation
├── Header/Magic Byte Validation
├── Threat Keyword Scanning
└── Import Table Analysis
↓
MicroAI Calculates Probability
↓
Decision:
├─ Safe: File Added to Distribution
├─ Suspicious: Moved to Quarantine
└─ Malicious: Marked as Threat
↓
Detailed Report Generated
├── Threat Score
├── Detection Reasons
├── File Properties
└── Recommended Actions
File Distribution
- Upload clean files to OffDrop
- Generate secure download links
- Share download link or QR code with recipients
- Recipients scan QR or enter token
- File downloads directly without internet
- System logs all downloads for audit trail
Security System
Access Control & Authentication
QR Code Token System
- Dynamic token generation per session
- IP address binding for token validation
- 10-minute time-to-live (TTL) for security
- Cryptographic hash-based token storage
Origin Validation
- Referrer header validation
- CORS policy enforcement
- Direct HTML access prevention
- Security headers middleware implementation
Threat Detection Engine
5-Feature Forensic Analysis:
File Size
Detects unusually large/small files indicating packing or manipulation
Entropy
Identifies compression/encryption indicating potential malware
Header Signature
Validates file type against 20+ magic number signatures
String Detection
Pattern matches 100+ threat keywords and dangerous APIs
Import Count (ImpHash)
Analyzes import tables and suspicious API calls
Advanced Detection Capabilities
- Ransomware Detection: High entropy + encryption keywords + C2 patterns
- Spyware Detection: Data exfiltration patterns, screen capture APIs
- Trojan Detection: Remote shell capabilities, backdoor signatures
- Botnet Detection: C2 communication patterns, remote command execution
- Worm Detection: Self-replication and network spread capabilities
- PDF Malware: JavaScript exploits, phishing URLs, embedded malware
- Packing Detection: UPX, Themida, ASPack identifiers
- Anti-Analysis Evasion: Debugger/VM detection code
Best Practices
- This is the first version of the applications
- Enable firewall and restrict network access
- Regularly backup all file data. While OffDrop is built for speed, it is not a long-term storage solution.
- We are still opened for feedback and improvements
- Review quarantine directory regularly
- Monitor system logs for unauthorized access attempts
- Regularly use the application's built-in reporting features before downloading any files
- Always Update the Application to the latest version
- Keep the application updated with the latest security patches
AI Threat Detection System
MicroAI Engine
The MicroAI engine is a lightweight machine learning model that calculates malware probability using weighted forensic features.
Probability Formula:
malware_probability = w1*fileSize + w2*entropy + w3*signature
+ w4*strings + w5*imports + bias
Result Range: 0.0 (safe) → 1.0 (malicious)
Detection Accuracy
PDF Detection
135+ signatures
Universal Files
All types
Supported File Types
Executables
.exe, .dll, .msi, .app
Documents
.pdf, .doc, .xls, .ppt
Scripts
.js, .py, .sh, .bat
Archives
.zip, .rar, .7z, .tar
Media
.jpg, .png, .mp4, .mp3
Web
.html, .css, .xml, .json
Threat Report Components
- Risk Score: 0-100 indicating malware likelihood
- Detection Details: Specific threats identified
- File Metadata: Size, timestamps, hashes
- Forensic Evidence: Entropy, signatures matched
- Threat Classification: Type of malware if detected
- Recommendations: Suggested actions
API Reference
POST /api/upload
Upload a file for threat analysis
Request: multipart/form-data with file
Response: { success, threatScore, analysis, quarantined }
Status Codes: 200 (success), 400 (invalid), 500 (error)
GET /api/security-token
Generate QR code security token
Request: GET request
Response: { token, qrCode, expiresIn }
TTL: 10 minutes
GET /api/files
List available files for download
Query Params: token (required)
Response: { files: [{name, size, uploadedAt, threatScore}] }
GET /api/quarantine
List quarantined suspicious files
Query Params: token (required), admin (optional)
Response: { quarantined: [{name, threatLevel, reason, timestamp}] }
POST /api/validate-token
Validate security token from QR code
Body: { qrHash, token }
Response: { valid, ip, expiresAt }
GET /api/download/:filename
Download a safe file
Query Params: token (required)
Response: File stream (binary)
Validation: Token checked against client IP
Troubleshooting
Application Won't Start
- Verify Node.js 18+ is installed: node --version
- Check all dependencies installed: npm install
- Verify port 3000 is not in use: netstat -tulpn | grep 3000
- Check file permissions on uploads directory
Upload Fails with Error
- Check available disk space: df -h
- Verify file permissions on uploads folder
- Check file size doesn't exceed limit (5GB default)
- Look for multer errors in server console
QR Code Not Working
- Verify token hasn't expired (10-minute TTL)
- Check client IP matches token binding
- Ensure both devices on same network
- Try generating new QR code
- Check QR scanner app compatibility
High Memory Usage
- Check for large files in uploads directory
- Clear old quarantine files regularly
- Monitor forensic analysis on large files
- Consider increasing system RAM
- Implement file size limits if needed
Files Incorrectly Flagged as Malicious
- Review threat analysis report details
- Check specific signatures that triggered alert
- Verify file is not packed or obfuscated
- Consider whitelisting legitimate files
- Compare with external malware scanners (VirusTotal)
Performance Issues
- Analyze large files asynchronously
- Implement request rate limiting
- Use reverse proxy (nginx) for load balancing
- Enable file compression for downloads
- Monitor and optimize forensic scanning
Frequently Asked Questions
General Questions
What is OffDrop used for?
OffDrop is a secure offline file distribution platform designed for fast, safe file sharing over local networks. It combines high-speed transfers with AI-powered malware detection, making it ideal for enterprise environments, educational institutions, and scenarios where internet connectivity is unavailable or unreliable.
Does OffDrop require internet connectivity?
No. OffDrop is designed to work completely offline over local Wi-Fi networks. Once installed, it operates independently without requiring any internet connection, making it ideal for air-gapped networks and restricted environments.
What platforms does OffDrop support?
OffDrop supports Windows (10+), macOS (10.13+), Linux (Ubuntu 18.04+), Android, and iOS. Native applications are available for each platform, providing a consistent experience across devices.
Features & Capabilities
How accurate is the malware detection?
OffDrop achieves 99.5% accuracy for PDF threat detection with 135+ specialized signatures, and 96%+ accuracy for universal file analysis across all file types. The AI system uses 5 forensic features (file size, entropy, header signatures, string detection, import analysis) to calculate malware probability.
What types of files can OffDrop analyze?
OffDrop analyzes executables (.exe, .dll, .msi, .app), documents (.pdf, .doc, .xls, .ppt), scripts (.js, .py, .sh, .bat), archives (.zip, .rar, .7z, .tar), media files (.jpg, .png, .mp4, .mp3), and web files (.html, .css, .xml, .json). The universal analyzer works with virtually any file type.
Can OffDrop detect ransomware and spyware?
Yes. OffDrop includes specialized detection for ransomware (high entropy + encryption keywords + C2 patterns), spyware (data exfiltration + screen capture APIs), trojans, botnets, worms, packing techniques (UPX, Themida, ASPack), and anti-analysis evasion code.
How does the QR code security system work?
OffDrop generates unique QR codes for each session. Each token is IP-bound (tied to the client's IP address) and expires after 10 minutes. The token is cryptographically hashed and validated on every file access, preventing unauthorized downloads and ensuring secure file distribution.
Installation & Setup
What are the system requirements?
Minimum requirements: Node.js 18.0+, 2GB RAM, 500MB disk space, and local Wi-Fi connectivity. Recommended: 4GB+ RAM for better performance with large files. Supported OS: Windows 10+, macOS 10.13+, Linux (Ubuntu 18.04+).
How do I install OffDrop on my system?
For development: Clone the repo, run 'npm install', then 'npm run dev' (access at http://localhost:3000). For production: Download the platform-specific installer from Windows_Version, Mac_Version, or Linux_Version folder and run the startup script. Each platform has dedicated installation instructions.
Can I run OffDrop on multiple devices simultaneously?
Yes. OffDrop is designed for local network distribution. You can run server instances on one or more devices and have clients on other devices connect via QR codes or security tokens. All connections are local and secure.
Usage & Operation
How long does threat analysis take?
Analysis time depends on file size and complexity. Small files (< 1MB) typically analyze in milliseconds. Larger files may take seconds to minutes. The system processes files asynchronously to prevent blocking.
What happens to flagged files?
Suspicious files are automatically moved to the quarantine folder (uploads/quarantine/). They are isolated from the main distribution pool and can be reviewed with detailed threat reports. Administrators can decide whether to delete, whitelist, or further investigate quarantined files.
How do I share files securely?
Upload clean files to OffDrop, generate a QR code or download link, and share with recipients. They scan the QR code or enter the security token to access files. Each token is time-limited (10 minutes) and IP-bound for maximum security.
Can I access the same files from multiple devices?
Yes. Uploaded files are stored centrally and can be accessed from any device on the same local network with a valid security token. Each device gets its own token, maintaining individual session security.
Security & Privacy
Is my data private and secure?
Yes. OffDrop operates entirely on your local network with no cloud storage or external connections. Files are stored locally, security tokens are cryptographically hashed, and all connections are IP-bound. Origin validation and CORS policies prevent unauthorized access.
How are security tokens protected?
Tokens are generated dynamically per session, cryptographically hashed for storage, bound to client IP addresses, and expire after 10 minutes. QR codes encode token hashes, making them difficult to intercept or reuse.
Can I use OffDrop in a restricted network?
Yes. OffDrop is specifically designed for restricted, air-gapped networks. It requires no internet access and works entirely on local Wi-Fi. This makes it ideal for government, military, and enterprise networks with strict security requirements.
How do I prevent false positives in threat detection?
Review threat analysis reports for detailed findings. Compare with external scanners (VirusTotal). Check if files are packed or obfuscated. You can whitelist legitimate files. Contact support if detection seems incorrect with evidence of the file's legitimate status.
API & Integration
Can I integrate OffDrop with other applications?
Yes. OffDrop exposes REST API endpoints for file upload, token generation, file listing, quarantine management, and downloads. You can build custom integrations, automate workflows, or connect to third-party tools using the documented API.
What API endpoints are available?
Main endpoints: POST /api/upload (threat analysis), GET /api/security-token (QR generation), GET /api/files (list safe files), GET /api/quarantine (list flagged files), POST /api/validate-token (verify tokens), GET /api/download/:filename (secure download). All endpoints require valid security tokens.
Is there API rate limiting?
Rate limiting can be configured based on your deployment needs. In production, implement rate limiting on upload endpoints to prevent abuse. Current defaults allow reasonable throughput for file distribution but can be customized per installation.
Troubleshooting
Why won't the application start?
Check if Node.js 18+ is installed. Verify all dependencies with 'npm install'. Ensure port 3000 is available. Check file permissions on the uploads directory. Review error logs in console output. Restart the application and check for specific error messages.
Why are file uploads failing?
Common causes: insufficient disk space, incorrect folder permissions, file exceeds size limit (5GB default), or network issues. Check available disk space with 'df -h'. Verify write permissions on uploads/ folder. Check file size and multer configuration. Ensure network connectivity.
Why is the QR code not working?
Possible issues: token expired (10-minute TTL), client IP doesn't match token binding, devices not on same network, QR scanner incompatibility, or corrupted QR code. Generate a fresh token and try again. Verify both devices are on the same local network.
Why is memory usage so high?
Large file analysis consumes memory during forensic scanning. Check for accumulated files in uploads/ directory. Clear old quarantine files regularly. Process large files asynchronously. Consider increasing system RAM if analyzing very large files frequently.
Why are legitimate files being flagged as malicious?
This can happen with packed, obfuscated, or newly released files that don't match known signatures. Review the threat report for specific triggers. Compare with external scanners. If confident the file is safe, whitelist it or contact support with evidence of legitimacy.
AI & Detection
How does the MicroAI engine work?
MicroAI is a lightweight ML model that calculates malware probability using 5 weighted forensic features: file size, entropy, header signatures, string detection, and import analysis. The formula produces a score from 0.0 (safe) to 1.0 (malicious). Thresholds determine quarantine/allow decisions.
What is entropy and why does OffDrop measure it?
Entropy measures randomness/compression in files. High entropy indicates encryption, compression, or packing—common techniques used by malware to evade detection. By calculating entropy, OffDrop identifies potentially obfuscated or suspicious files.
Can OffDrop detect zero-day malware?
OffDrop uses behavioral and forensic analysis rather than signature-based detection alone, making it more effective against unknown malware. However, sophisticated zero-days designed to bypass heuristics may not be caught. OffDrop is best used as part of a layered security approach.
For more information or support, visit the project repository or drop an email
OffDrop © 2026 | Secure Offline File Distribution Platform
Documentation Version 1.0.0