Quick Sync — Real-time Ephemeral Device Transfer

The problem it solves

Cross-device clipboard sharing is a
surprisingly unsolved problem.

AirDrop is Apple-only. Cloud drives require accounts and apps. Browser sync is locked to one ecosystem. Quick Sync works on any device with a browser — phone, laptop, tablet, Windows, Mac, Linux — with zero setup. Open the site on both devices, enter the same room code, done.

How it works

Create a room

Choose between Public mode (base64-obfuscated) or Secure Mode (AES-256-GCM encrypted). One click, no account required.

Get your 6-character code

A short uppercase room code is generated. Open the same code on any other device — browser, phone, tablet, anything.

Type or drop files

Text syncs instantly as you type. Drag-and-drop files up to 50MB. All connected devices see changes in real time via Supabase broadcast channels.

Destruct when done

One button nukes the room, all text, and every uploaded file from Supabase Storage. Every connected device gets the "ROOM VAPORIZED" screen instantly.

Room Code

AB3F7X

Same code on any device

End-to-end encryption

The server genuinely cannot decrypt your content.

Secure Mode — how the key works

Key Never Touches the Server

Client A → crypto.getRandomValues(128-bit key)

URL hash → /room/ABCDEF#a1b2c3...key

↑ hash fragment: browser-private, never sent to server

Text → AES-256-GCM encrypt → Supabase DB

Files → encrypt raw binary → Supabase Storage

Client B → reads key from URL hash

→ decrypts locally — server never involved

Supabase breach → useless ciphertext

Key Generation

128-bit random hex key via crypto.getRandomValues — the Web Crypto API, not a library. No predictable seed.

Key Delivery

Appended to the URL as a #fragment. Browsers never include fragments in HTTP requests — the key is physically impossible to intercept at the server layer.

Encryption Algorithm

AES-256-GCM with a 12-byte random IV per operation. GCM provides both confidentiality and authenticity — tampered ciphertext is detected and rejected.

Real-time sync architecture

Differential patches, not full content on every keystroke.

Sync flow

Device joins → fetches from DB

A new device opening the room code fetches the latest content from Supabase, decrypts if in Secure Mode, and renders the current state.

Subscribe to broadcast channel

All connected devices join a Supabase Realtime broadcast channel keyed by room code. Low-latency peer sync begins.

Keystroke → broadcast diff

Only the diff (insert/delete operation) is broadcast on each keystroke — not the full content. Fast even on slow connections.

2-second DB debounce fallback

The full content syncs to the database on a 2-second debounce. Devices that join late always catch up from a consistent DB snapshot.

Destruct → postgres_changes event

Room deletion fires a postgres_changes DELETE event. All connected clients receive it instantly and are shown the ROOM VAPORIZED screen.

Why Differential Sync

Only the change travels the wire

A naive implementation would broadcast the entire textarea content on every keystroke. On a 50KB document at 300WPM, that's megabytes per second. Quick Sync broadcasts only the operation: insert(pos, chars) or delete(pos, len) — a few bytes regardless of document size.

Undo / Redo

Local history stack per session

Each device maintains its own local undo/redo stack. Operations are applied locally first for zero perceived latency, then broadcast. The DB acts as the authoritative fallback.

ROOM VAPORIZED

postgres_changes DELETE · all clients notified

Key features

Everything you need. Nothing you don't.

Char room codes

50MB

Max file size

256

Bit AES-GCM key

Infrastructure cost

File Sharing

Drag-and-Drop, Encrypted in Transit and at Rest

Upload any file up to 50MB directly from the room page — drag onto the drop zone or click to browse. In Secure Mode, files are encrypted as raw binary (not base64) before upload, using the same AES-256-GCM room key. Files stored in Supabase Storage are just opaque blobs without the URL hash key. Other devices in the room can download instantly.

Admin Panel

Hidden Control Plane

Accessible at a hardcoded secret room code. Shows all active rooms, file counts, content size, public/private mode, and last-modified date. Per-room actions: clear files only, or full delete. Includes an orphaned storage scanner for files left behind after rooms expire.

Public Mode

Base64 Obfuscation · No Key Required

When encryption isn't needed, Public rooms use base64 encoding for light obfuscation. Share the room code — no hash fragment needed. Ideal for non-sensitive snippets.

No Persistence

Ephemeral by Design

Rooms have no scheduled expiry — they persist only as long as they're useful. The destruct button is one tap and the room, all text, and all files are gone from the server entirely. No recovery.

Universal

Any Device · Any OS · No Install

Pure browser app. No native install, no extension, no account. Works on Chrome, Firefox, Safari, Edge — on Windows, macOS, Linux, iOS, Android.

Design

Dark + Light Mode

Full dark/light mode via next-themes. Animated gradient blob background using CSS keyframes — no JS canvas. Framer Motion stagger animations on the landing page.

Monospace Terminal Aesthetic

The room editor uses a monospace font. Room codes are uppercase. The destruct screen says "ROOM VAPORIZED" in red. Deliberately minimal — the focus is the content, not the chrome.

Cost

Zero Infrastructure Cost

Runs entirely on free tiers. Supabase free plan covers realtime channels, database, and storage. Cloudflare Pages hosts the frontend. Auto-deploys on push to main.

Tech stack

React 18 TypeScript Vite Tailwind CSS shadcn/ui Framer Motion Zustand Supabase Realtime Supabase Storage PostgreSQL Web Crypto API AES-256-GCM Cloudflare Pages GitHub Actions

Deployment pipeline

Push to main

GitHub receives the push. Cloudflare Pages build hook fires immediately — no manual trigger needed.

Cloudflare builds

vite build runs in the Cloudflare Pages build environment. TypeScript, React, and Tailwind compiled and minified.

Global edge deploy

Static assets pushed to Cloudflare's global CDN. Zero downtime swap. Live at quick-sync.pages.dev within seconds.

↗ GitHub ↗ Live App ↗ Portfolio

QuickSync.

Cross-device clipboard sharing is asurprisingly unsolved problem.

The server genuinely cannot decrypt your content.

Differential patches, not full content on every keystroke.

Everything you need. Nothing you don't.

Cross-device clipboard sharing is a
surprisingly unsolved problem.