Cross-device clipboard and file sync that doesn't touch the cloud.
CDUS connects your Linux, Windows, macOS, and Android devices directly over your local Wi-Fi. Authenticated with the Noise Protocol. A single native Rust binary running quietly in the background under 18 MB of RAM.
curl -fsSL https://cdus.dev/install.sh | bashHow CDUS operates
No cloud servers, no account logins, and no complex network setup.
Out-of-band QR authentication with Noise XX
When pairing two untrusted devices, your desktop displays an ephemeral QR code encoding its local socket and temporary public key. Pointing your phone's camera at the screen initiates a 3-way Noise_XX Diffie-Hellman handshake.
Both screens display matching 6-digit confirmation numbers derived from the cryptographic transcript. Once accepted, devices store public keys in the operating system's native hardware keychain.
Read the cryptographic specification →$ cdus pair --qr
Listening on 192.168.1.104:4242
[+] Received Noise XX message 1 from 192.168.1.182
[+] Sent Noise XX message 2 (e, s, ee, se)
[+] Mutual authentication verified.
Confirm 6-digit SAS matches on peer: [ 849 203 ]
[+] Device 'Pixel 8a' added to OS keychain.Thread-pipelined sync without async runtime starvation
Heavy asynchronous frameworks can suffer from thread-pool starvation when gigabyte disk I/O shares an executor with real-time socket events.
CDUS uses dedicated OS threads linked by bounded Flume channels. Sockets, decryption stages, disk writers, and clipboard pollers run on isolated pipelines. A 50 GB file transfer running at max wire speed will never add even 5 milliseconds of delay to your clipboard sync.
Explore the thread pipeline architecture →$ cdus status --verbose
Daemon: Running (pid 14201, uptime 4d 12h)
Memory RSS: 14.2 MB (sustained)
Channels:
• rx_socket_queue: 0 / 128 (empty)
• decrypt_stage: 0 / 64 (empty)
• disk_chunk_pool: 4 / 64 (streaming)
Clipboard latency: 14 ms (p99)Direct LAN sockets with zero-knowledge relay fallback
Whenever possible, devices stream directly across local Wi-Fi or Ethernet at native NIC speeds. But if you connect through a mobile hotspot or hotel Wi-Fi with client isolation enabled, CDUS falls back to an open-source TURN relay.
The relay forwards encrypted Noise packets blindly without holding private keys. Every 1 MB chunk is tree-hashed with BLAKE3. If your laptop drops off the network, the transfer resumes instantly from the exact missing chunk upon reconnection.
Review network fallback mechanics →$ cdus transfer resume 9f84a2
Target: /home/user/Downloads/backup.tar.zst (4.2 GB)
Scanning existing chunks on disk...
[========================] 3,410 / 3,410 verified (BLAKE3)
Requesting missing chunks: 3,411..4,200
Reconnected via LAN Direct (192.168.1.182:4242)
Transfer completed in 6.4s without full retransmission.Comparison with alternatives
A transparent look at architectural tradeoffs across popular tools.
| Feature / Capability | CDUS | AirDrop | KDE Connect | LocalSend | Cloud Sync |
|---|---|---|---|---|---|
| Operating Systems | Linux, Win, Mac, Android | Apple devices only | Linux, Android (Win/Mac partial) | Cross-platform | Cross-platform |
| End-to-End Encryption | Noise XX & IK (ChaChaPoly) | TLS / Apple Identity | TLS (RSA/ECDSA) | HTTPS / TLS | Varies / Cloud-managed keys |
| Zero Cloud Upload | 100% Local-First | Local P2P | Local P2P | Local P2P | Uploads to Cloud Servers |
| NAT / Firewall Fallback | Encrypted TURN Relay | Fails outside LAN/BT | Fails if LAN blocked | Fails if LAN blocked | Cloud routed |
| Background Sync Footprint | < 18 MB RAM (Native Rust) | Native OS Daemon | 50–120 MB (Qt / JVM) | 70–160 MB (Flutter) | 120–400 MB (Sync Clients) |
| Requires Account / Login | No account needed | Requires Apple ID | No account needed | No account needed | Mandatory Account |
| Chunked Transfer Resume | Yes (BLAKE3 1MB chunks) | Restarts from 0% | Restarts from 0% | Restarts from 0% | Chunked upload |
Supported platforms
Direct native installers built from our continuous integration matrix.