How Just Share keeps a share private.

Share codes

Each folder you share gets its own share code: 32 letters and numbers that Just Share creates at random. A share code works like a password for that one folder. It lets someone find your computer and ask to join the folder. It does not give access to anything else on your PC.

• Limited share codes. You can create a share code that works only once, or that stops working on a date you choose. This is useful when you are sending something to one person.
• Changing a share code. You can change a folder’s share code at any time. The old one stops working straight away.
• Two-way folders have a separate share code for people who are allowed to change files. The standard share code can only download.

You decide who gets in

When someone enters your share code, Just Share asks you whether to let them in. This is on by default for every new share. Until you say yes, that person receives nothing: no files, no list of what is in the folder, and no way of finding the other people who have it.

You can remove a person at any time. Their computer is blocked from the folder, and the people who remain are moved to a new private meeting place that the removed person does not know about. If you want to be certain they cannot ask again from a different computer, change the share code as well. In a two-way folder the meeting place does not move, so change the share code there.

Checking it is really them

Anyone can give their computer any name, so the name on a request does not prove who is asking. For that, each connection has a check code: twelve digits worked out from the encryption keys of the two computers. Your screen and theirs show the same code, and nobody else’s connection can produce it.

To use it, contact the person some other way, such as a phone call, and ask them to read out their check code. If it matches the one on your screen, you are connected to their computer. You can then mark that computer as verified, and Just Share will show it as verified whenever it appears.

Encryption

Every connection is encrypted from end to end using the Noise protocol, with keys that only the two computers hold. The network between them carries the data but cannot read it.

• No relay servers. Just Share does not run any, and an unmodified copy of the app never asks for a connection to be relayed.
• Finding each other. Computers find each other through a public peer-to-peer network. It sees an IP address and a scrambled identifier for each share. It never sees share codes, file names or files.
• Proving the share code. When two computers connect, each proves it holds the share code without sending it. Details such as your computer’s name are sent only after that, and someone who has not yet been let in sends their name only to the sharer.

Every file is checked on arrival

The sharer’s computer works out a fingerprint (SHA-256) for every file. When a file arrives, the receiving computer works out the fingerprint again and compares the two. A file only appears in the folder once it matches. If it does not match, it is downloaded again.

The sharer can see when each person’s copy is complete and checked, and can export a delivery record listing every file, its fingerprint, who received it and when.

Other people receiving the same folder

People receiving the same folder can pass finished files to each other, which makes large shares faster and lets a download finish if the sharer goes offline. This only happens between people the sharer has let in:

• When the sharer lets someone in, it gives their computer a signed pass. Other receivers will not send that person anything, or tell them anything about the folder, without it.
• Receivers find each other at a private meeting place that only people who have been let in know about. Someone who has the share code but has not been let in cannot find them.
• The sharer can turn this off for a folder, and each receiver can turn off helping others.

Sharing that stops by itself

A share does not have to stay open. You can have a folder stop sharing once everyone has all the files, or after a set time of an hour, a day or a week. You can also pause or stop any share yourself whenever you like.

On your computer

• Stored share codes are encrypted with a key that Windows protects for your user account, so they cannot be read from a copy of the settings file or by another Windows account.
• An optional lock. You can have Just Share ask for Windows Hello (your fingerprint, face or PIN) when it opens, before it shows your folders and share codes. Windows does the checking, and Just Share never sees your fingerprint, face or PIN.
• Programs you receive are marked as downloaded. Windows then checks programs, installers and scripts before they open, as it does for files downloaded in a browser.
• Installed from the Microsoft Store, which also delivers updates.

What Just Share can’t protect you from

No tool can promise everything, and you should know where the limits are.

• People you let in. Once someone has your files, they can keep them and pass them on. A library is not saved on a viewer’s computer by Just Share, but nothing can stop someone recording their own screen.
• IP addresses. Because the computers connect directly, the people you share with can see your IP address, as can the public network that helps computers find each other. The table on the home page lists what each party can see.
• While someone is joining. A person joining a folder for the first time only has the share code to go on. Until the sharer lets them in, anyone else who has that share code can connect to their computer and see its IP address, but not its name or anything else.
• A share code sent to the wrong person. Approval stops them getting the files, but treat a share code like a password and send it only to people you mean to have it.
• A computer that is already compromised. Just Share cannot protect files from malicious software running on your PC or on the PC of someone you share with.

Reporting a problem

If you think you have found a security problem in Just Share, please tell us: justshare.p2p@gmail.com

For what information the app handles and who can see it, read the privacy policy.

Back to Just Share