Hermod -

I have always wanted a simple way to send text and files securely between computers regardless of where they are. Without having to go through cloud services that you trust more or less. That’s why I created hermod!

Automatically translated from Norwegian by AI: DeepSeek V4 Flash

Quick start

See the full manual and download the program from GitHub - aheimsbakk/hermod: Hermod is a post-quantum secure by default peer-to-peer (P2P) file and text transfer application.

# Trust (TOFU) demo signal server
./hermod-linux-amd64 trust hermod.sanntid.org

# Send a file
./hermod-linux-amd64 send report.pdf 
Transfer code: 39758-scam-grape-pace

# Receive the file on another machine
./hermod-linux-amd64 receive 39758-scam-grape-pace
Establishing P2P connection...
Saved to report.pdf
Transfer complete.

Short forms:

send | tx
receive | rx

Signal server

I recommend running your own signal server. It is super easy! Make sure TCP and UDP port 4376 is open in your firewall. You can change the port to whatever you want.

# Start signal server
./hermod-linux-amd64 serve

History

In 2016 I saw Magic-Wormhole: Get Things From One Computer To Another. The idea is good. But I felt it lacked a bit in security.

Many years passed. Then came AI-assisted coding, agentic coding, vibe coding, call it what you will. Suddenly the task of creating the program I had wanted became manageable. The focus could be on architecture, implementation and the result without taking up all free time for the better part of half a year.

The result was hermod, with a strong focus on security at every level.

Differences between Hermod and Magic Wormhole

AI was used to go through Hermod’s repo and Magic Wormhole’s three repos. It was asked to summarize the 7 most important security differences between Magic Wormhole and Hermod.

Magic Wormhole:

Hermod:

aheimsbakk/hermod

Hermod vs Magic Wormhole

Area	Hermod	Magic Wormhole
Withstands quantum computers	Yes. Uses ML-KEM-768 (FIPS 203) in all sessions by default.	No. No protection against quantum computer attacks.
Data in transit between you and recipient	Goes directly between you and the recipient via QUIC with TLS 1.3. No third party can see the data.	Goes via a transit relay server. You must set up TLS yourself — default is unprotected TCP. Tokens and metadata are visible on the network if you don’t.
What the signaling server stores	Channel lists in memory (never on disk). Only encrypted blobs — cannot read message content.	Your messages in plaintext in SQLite on disk, along with IP addresses and protocol phases.
Protection against overload	3 independent rate limiters, limits per IP and per channel, limits on message size.	None. No safeguard against someone overwhelming the server with requests.
The code you share (default)	3 words from 1296-word list (~31 bits). About 700 times harder to guess.	2 words from 512-word list (~18 bits). An attacker can guess easily.
Verification of the other party	Shared code + temporary certificates + optional extra verification via 6 words and identicon.	Via shared code only (PAKE). No extra check of who you are talking to.
Software dependency security	Single static executable. No runtime dependencies. All crypto functions from Go standard library (FIPS 140-certified).	3 separate systems (client + 2 servers), many external Python packages, several without version locking.

app security p2p

Hermod

Post-quantum secure P2P file and text transfer