byhand

What for

• Let an AI agent publish its work and read your feedback: you annotate from your phone, it reads the comments and makes the next version.
• Review a mockup, a report or a dashboard live in a call, everyone commenting from their phone.
• Show a sensitive document without handing it over: stop sharing and the link is dead.
• A poll, a quiz or a shared list for a workshop or an event.
• A recipe, a to-do list or shared expenses with friends.

Get started

1. Install the app: one program, no account, nothing else to install.

   Linux:

   curl -fsSL https://byhand.page/install.sh | sh

   Windows (PowerShell):

   irm https://byhand.page/install.ps1 | iex

   The script checks the download's SHA-256 before installing it. macOS: not yet.

2. Run it in the background, then get your private page:

   byhand install
   byhand me

   byhand install starts with your computer. byhand me prints your private link (and its QR code, for your phone): keep it to yourself, it controls your shares.

3. Everything else happens in your browser, on Your pages: share an HTML file, make a page by describing it to an AI (with your own API key, kept on your computer), read and answer what viewers said, stop a share. From any browser, your phone included.

   Prefer the terminal? byhand share -b page.html prints the link and its QR code. Saving the file publishes a new version; a folder (index.html with its CSS, scripts and images) works too.

When your computer is off

A link opens while one of your devices shares it. To keep it open when they are all off, add a guardian: another computer of yours, a home server, or a friend's. It keeps an encrypted copy of your pages that it cannot read, serves them while you are away, and keeps what viewers say until you are back.

That is the only copy of your pages outside your devices, and only if you add one.

See "Guardians" below. A guardian drops a copy after 30 days without news from you.

How your page travels

Always encrypted end to end and signed by you. What changes is the road:

• A reader opens your link

  The gateway only introduces them: the reader's browser and your device exchange a sealed offer through it, then the page, the comments and the messages go straight between your device and the reader (WebRTC). The gateway does not even see them pass.

• When a network blocks the direct path

  Some corporate or mobile networks forbid direct connections: then your device's connection to the gateway carries the page, as encrypted bytes it passes on and does not keep.

• While your computer is off

  The gateway fetches the page peer to peer from a guardian (or from your device, when you share peer to peer) and passes it on. Same: encrypted bytes, nothing kept.

• Between your devices, co-authors and guardians

  Directly, device to device, also for byhand get. A public relay passes the encrypted traffic only when a network blocks the direct path. The gateway is not involved.

Every way a page reaches a reader (direct, a TURN server, the gateway) and your devices find each other (the DHT, pkarr relays, your own relay, hiding your IP address), with the pros and cons of each: https://byhand.page/network.

Your own gateway

You don't have to trust this one. The byhand program is the gateway too, pages included: run it on your own server and nobody else's is on the path between you and your readers. Your name in the links, the metadata (which page is opened, when, from where) stays with you, and your links don't depend on https://byhand.page.

byhand gateway --listen 127.0.0.1:8080 --bridge

Put HTTPS in front (for example Caddy: reverse_proxy 127.0.0.1:8080 with header_up X-Real-IP {remote_host}, and BYHAND_TRUST_PROXY=true for the gateway). Then, on each device: curl -fsSL https://your.domain/install.sh | sh and byhand me --url https://your.domain: your private page and your new links use it. --downloads <dir> offers the builds for other systems. --pkarr makes it the relay your devices find each other through (--pkarr-relay https://your.domain/pkarr --no-dht): no public service at all. Every option: network.

Hosting rules: some hosts ban BitTorrent traffic, the DHT included (one banned byhand's first account). The gateway never uses it. The app running on a server (a guardian, a peer to peer share) does by default: there, install it with byhand install --server (or add --no-dht), so its records go through HTTPS relays only.

Advanced use

Guardians

On your computer: byhand me invite --guardian shows a code. On the guardian: byhand guard join <code>, then byhand install so it keeps running. --link gives an invitation link to send instead. For one page only: byhand share invite --guardian page.html.

Your other devices, co-authors

byhand me invite here and byhand me join <code> there: the same private page, your shares served by either. For one page with someone else: byhand share invite page.html, then byhand share join <code>: both can edit it, same link.

Single-use link

byhand share -b --once page.html: the first reader opens it, anyone after is told it was opened already, so you know if someone else had the link.

Link preview

--preview: when the link is pasted in a chat app, it shows the page's title, its description and og:image. Off by default, since that part is public.

Pages made by AI

byhand me ai sets the model (Anthropic or any OpenAI-compatible API) and its key, kept on this computer. Then byhand make "a shared shopping list" -o list.html, or --from <url> to make a page from an article.

AI agents

byhand inbox, byhand reply and byhand dm read and answer viewers from a terminal, so an agent can publish, read the feedback and publish the next version. Instructions for agents: https://byhand.page/llms.txt.

Reading without the gateway's code

byhand get <link> fetches a page, checks its author's signature and decrypts it with the app.

Without the app

With Node.js 22 or newer: curl -fsSO https://byhand.page/share.mjs, then node share.mjs page.html (no guardians, no peer to peer).

Security, plainly

The short version. The full one, with who sees what: https://byhand.page/security.

• The key is the part of the link after #: browsers never send it, so the gateway only sees encrypted bytes and the page's id.
• Every version is signed by its author: neither the gateway nor a guardian can slip in a fake one.
• Limit: in a browser, the code that decrypts the page comes from the gateway. A compromised gateway could serve code that steals the key. Run your own gateway to trust only yours; byhand get does not depend on any.
• Whoever has the link can read the page, and can save a copy. Stopping a share stops new readers, not copies already made.
• Peer to peer, your devices publish that a page exists and which devices serve it, never its content.
• Viewer names are what viewers type: not verified.

For AI agents

If you are an LLM asked to send or share an artifact on https://byhand.page: read https://byhand.page/llms.txt for the instructions and the artifact rules. Give the user the link exactly as printed (https://byhand.page/a/<id>#<key>; the part after # is the decryption key, it never reaches the server).