PeerSync keeps chosen folders identical across your Windows PCs, device to device. A folder key is the only thing you share. Files travel encrypted and signed over your LAN or across the internet, and never pass through anyone's server in readable form.
A Windows service does the work. A small dashboard and a CLI control it. Everything in between is designed so that a stolen laptop, a nosy network or a compromised relay gives an attacker as little as possible.
Every folder has one random read-write key. A read-only key and an encrypted-peer key are derived from it one way, never back. Whoever holds a key has exactly that level of access, nothing more.
LAN multicast with hourly-rotating tags so observers cannot track your folders. A tracker for peers across the internet. Fixed hosts when you know the address. A relay only when nothing else works.
QUIC gives encryption, multiplexed streams and UDP hole punching in one in-box Windows stack. When UDP is blocked, PeerSync falls back to TCP with TLS 1.3, and then to the relay.
Files are cut into content-defined chunks and hashed with BLAKE3. Insert a paragraph at the top of a document and only the chunks around it move, not the whole file. Peers swarm chunks from each other.
Each change record carries an Ed25519 signature derived from the read-write key. Read-only peers verify but cannot sign, so a tampered read-only device can't inject anything into your folder.
When two devices edit the same file, the newer version wins and the other goes to the archive instead of vanishing. Deleted and overwritten files stay restorable for 30 days.
The engine runs as a service under its own virtual account, so folders keep syncing when nobody is signed in. A WPF dashboard and tray icon give you status, pause and resume, share keys and pending devices.
One optional Windows Server component does discovery and relays opaque, end-to-end encrypted traffic when peers can't connect directly. It never receives folder keys or plaintext files. LAN-only sync needs no server at all.
One command collects a sanitized support bundle: structured events, timings and error codes, with network addresses, paths, keys and file contents left out by default. Share it without a second thought.
No sign-up flow, no inviting people by email, no waiting for a cloud to catch up. Two PCs find each other on the LAN within seconds, or through your rendezvous server when they are apart.
All three derive from one 32-byte secret. The derivation only runs forward: a read-only key can never recover the read-write key.
| Key | Who holds it | Grants |
|---|---|---|
| A… | Read-write devices | Sign changes, read, decrypt |
| B… | Read-only devices | Verify, read, decrypt; local edits never leave |
| F… | Untrusted backup devices (planned) | Store and seed ciphertext only |
Case, spaces and dashes are ignored on paste. Key text is never written to logs, and key objects redact themselves when printed.
Holding a folder key. TLS 1.3 between pinned device certificates. Signed change records. Everything else is a consequence of those three.
The rendezvous server never sees a key or a byte of file content. Self-host it, and there is no third party left at all.
LTS
QUIC MsQuic / Schannel
TLS 1.3 AES-GCM / ChaCha20
Ed25519 signed records
BLAKE3 content hashes
FastCDC chunking
HKDF-SHA256 key chain
SQLite per-folder state
DPAPI + CNG secrets at rest
Own protocol PSP/1
Everything the dashboard shows, the psp CLI prints. Check status from a remote shell, add folders in a provisioning script, probe your server, or collect a sanitized bundle for a bug report.
psp statusFolders, peers, transfer state and clock warningspsp add D:\ProjectsCreate a folder and its keyspsp join <key> C:\Sync\ProjectsJoin with a read-write or read-only keypsp probe sync.example.com:99Verify TCP and UDP reachability of your rendezvous serverpsp diagnostics --output bundle.zipSanitized support bundle, no keys, paths or addressesPS C:\> psp status PeerSync service running device Q7MX-3KJ2-RW5H-N6CY Projects D:\Projects RW state synced 1,284 files · 3.9 GB peers 2 online laptop LAN/QUIC · workshop relay archive 17 versions oldest 11 days Photos 2026 E:\Photos\2026 RO state syncing 43% receiving 412 MB from 1 peer peers 1 online desktop-home LAN/QUIC PS C:\> psp probe sync.example.com:99 { "tcp": { "reachable": true, "http2": true }, "udp": { "reachable": true, "http3": true }, "observedAddress": "203.0.113.42:51876" } PS C:\> _
Install on PC A, add a folder, copy its key. Install on PC B, join with that key. Create a file on either side and watch it appear on the other. That is the whole onboarding.
Want to host discovery and relay for your own team? The rendezvous operations guide covers certificates, firewall rules and probes.