Security

• End-to-end encrypted. Every connection between your devices is encrypted with Noise (libp2p). Luwu's relays forward encrypted bytes they can't read.
• Direct when possible. Devices connect directly when the networks allow; otherwise through a Luwu relay (Los Angeles, Hong Kong and Frankfurt).
• Your keys stay on your devices. Each computer and phone makes its own key. Luwu's server certifies which account a key belongs to; it never sees private keys.
• You approve every new device. A new phone or browser waits until a device that already has access, or luwu devices approve on the computer, lets it in. An account password alone doesn't open your computers.
• Every connection is checked twice. By the relay (only your own devices reach your computers) and by the computer itself, which verifies the other device's certificate: signed by Luwu, for this account, not expired, not revoked.
• Revocation. Remove a device and your computers drop it within minutes.
• Short-lived certificates. Device certificates last 7 days and renew automatically. A friend's pass lasts as long as the share.
• Your secrets aren't shared. See Files for the folders and files Luwu never shares.