Magic Wormhole review: send a file with a short code

Magic Wormhole is a free file-transfer tool for a file, a folder, or a short note.¹⁶ You read a short code aloud, and the other person types it into their copy.¹ That code builds a shared key, so the mailbox that introduces the computers cannot read the encrypted messages.⁴

Last checked October 28, 2026.

At a glance

What it is: A command-line program that sends a file, folder, or short text when both people use the same code.¹

Works on: Linux, macOS, and Windows, on Python 3.10, 3.11, 3.12, or 3.13. The docs also list a GNOME app and an Android app.¹

Price: Free. The public mailbox stays up for as long as the project can run it.¹⁶

Licence: MIT.¹⁶

Best for: A one-off handoff while you can talk, with both programs left open.¹

Official site: magic-wormhole.readthedocs.io

What Magic Wormhole does (and how it protects your privacy)

The command-line tool is named wormhole. It moves a file, a folder, or a short text.¹ The sender shows a code and the receiver types it. Codes are short, taken from a word list, and each one works once.¹ The documented example is 7-crossover-clockwork. The receiver sees the name and size and is asked ok? (y/n) before the file is written.¹

The protection is a password-authenticated key exchange, or PAKE: a short shared password becomes a strong key during the connection, so a guess has to happen live, not offline later. Magic Wormhole uses SPAKE2.¹ A malicious mailbox gets one guess.¹ If that guess works, one of the two people sees the connection fail, usually with a “crowded” or “scary” error.¹ Later traffic uses keys from that secret. File data uses NaCl secretbox, from libsodium.¹⁵

On the same local network, or when one computer has a public address, they connect directly. If both can only call out, a transit relay carries bytes that are already encrypted.¹ The relay joins the two connections and copies what arrives on one out to the other.⁵ Setup messages use a mailbox. The default is relay.magic-wormhole.io.⁴ In May 2026 the docs still called version 1 the only deployed version.⁴ Both sides must use the same mailbox, and you can run your own.¹

Key Magic Wormhole features

A spoken code: Short, single-use words, with tab-completion.¹
Files, folders, or a note: wormhole send takes a file, a folder, or --text. wormhole receive accepts it.¹
Direct when it can: Same-network transfers try a direct link. Otherwise the encrypted relay is the fallback.¹
One guess: The default code has 16 bits of randomness, a 1-in-65,536 chance on that try.¹³
A stricter check: --code-length adds words. --verify prints an extra string to compare.¹
Your own servers: --relay-url picks the mailbox. --transit-helper overrides the transit relay.¹
A window instead: The docs list Warp, a GNOME app that works with the command line, and Wormhole for Android.¹
The latest numbered release: Version 0.24.0, dated 5 May 2026.²

Magic Wormhole pros and cons

Pros

The MIT licence is free of charge and allows copying and modification.⁶
After the key is set, the mailbox cannot read the messages. Only the PAKE setup sits outside that encryption.⁴
On one local network the file can go straight between the computers.¹
A successful guess shows up: one of the two people sees the connection fail.¹
You can run the mailbox and the transit relay yourself.¹

Cons

Both people need the program, and both copies must stay open until the end. There is no built-in timeout.¹
This package is a command line. Warp and the Android app are separate programs.¹
Anyone who hears the code can connect. On an insecure channel, that person can step in for certain.³
A network attacker, or the mailbox operator, gets one guess in 65,536.³
The public mailbox is a single point of failure, and the author calls the public relay best-effort.³
The mailbox learns your IP address. A relay can see sizes, timing, and addresses, and the other person is sent your address inside the encrypted channel.¹⁴⁵

Is Magic Wormhole safe and private?

The licence copyright names Brian Warner, from 2015.⁶ The latest numbered release is 0.24.0, from 5 May 2026, and the docs list Python 3.10, 3.11, 3.12, and 3.13.¹² The docs open with “Get things from one computer to another, safely.”¹

The documented commands are send and receive, and the example never asks you to sign in.¹ The mailbox welcome may include your-address, the IP address and port you appear as.⁴ It keeps messages across a restart, and it records a mood such as “happy”, “lonely”, or “scary”.⁴

Transit uses NaCl secretbox. A passive watcher can learn record sizes, timing, and the IP addresses, and cannot change a record without the link dropping.⁵ Say the code on a channel you already trust.³ --verify adds a comparison that does not depend on that channel staying secret,¹ and --code-length=4 lengthens the code if failures pile up.³

Use a current release. On 10 March 2026, version 0.23.0 fixed a path-name bug in 0.21 and 0.22, and the notes say to upgrade.² On 5 May 2026, version 0.24.0 fixed a related case, CVE-2026-42448, when --output pointed at an existing folder.²

How to get started with Magic Wormhole

Install from the project’s instructions. Debian and Ubuntu: sudo apt install magic-wormhole. macOS: brew install magic-wormhole. Windows: winget install -e --id magic-wormhole.magic-wormhole. The docs say those Windows binaries come from the separate magic-wormhole-exe project. With no package, run pip install magic-wormhole on Python 3.10, 3.11, 3.12, or 3.13. The latest numbered release is 0.24.0.¹²
The other person runs it too, while you are already talking.¹
Run wormhole send and the file or folder. For a note, use wormhole send --text. Read the code on a channel you trust.³ Add --verify or --code-length for a stricter handoff.¹
They run wormhole receive, type the code, and answer yes only if the name and size match.¹
Leave both programs open until the transfer finishes. The docs expect both sides within about an hour, and there is no timer.¹ On “crowded” or “scary”, start again. If your copy is older than 0.24.0, update first.²

Who should use Magic Wormhole (and who might prefer something else)

It fits a one-time send to someone you can talk to now. The project’s examples are a file for a friend, a password over the phone, and an SSH key for a later login.¹ For a new password, use BellCrier’s generator: bellcrier.com/password-generator. It fits less well when the other person cannot install software, or the file must wait online for hours.

For a browser send with nothing to install, use PairDrop. For a lasting link between your own phone and computer, use KDE Connect. For a short note that should stay on a page, use PrivateBin.

Frequently asked questions

Is Magic Wormhole free?

Yes. The MIT licence is free of charge and allows use, copying, and modification.⁶ The built-in public mailbox is offered until volume or abuse makes that impossible.¹

Is Magic Wormhole safe?

The file is encrypted with a SPAKE2 key and NaCl secretbox.¹⁵ A network attacker or a malicious mailbox gets one guess at the default code.³ Use 0.24.0, the latest numbered release: it includes the fix for CVE-2026-42448, and 0.23.0 fixed an earlier path bug in 0.21 and 0.22.²

Does Magic Wormhole work on Windows and phones?

Yes. The install notes cover Windows, macOS, Debian, and Ubuntu. Fedora removed the package starting with Fedora 37.¹ The same page lists Wormhole for Android and Warp, a GNOME app that works with the command line.¹

Does the Magic Wormhole server see my file?

It cannot read the encrypted messages. It handles the PAKE setup and does not learn the shared secret.⁴ The relay forwards those records, but a watcher can see sizes, timing, and IP addresses.⁵ Your address is also sent to the other computer inside the encrypted channel.¹