Launching AmanMaps: A Privacy-First Way to Share Between Your Phone and Computer

I kept doing the same small, dumb thing multiple times a day: opening WhatsApp, scrolling to my own contact, pasting a link or a snippet of text, sending it to myself, then switching to my computer to grab it. It worked, but it bothered me every single time.

So I built AmanMaps.com . Open it on your computer, scan a QR code with your phone, and whatever you type or paste on your phone shows up instantly on your computer — and now, the other way around too. No app to install, no account to create.

The part I cared about most wasn't the QR pairing it was making sure the tool didn't become another place your data quietly sits forever. The connection is peer-to-peer over WebRTC: your phone and your computer talk directly to each other. My server's only job is to briefly introduce the two devices to each other during the handshake, then it steps out of the way completely. Refresh the page, and the session and everything shared in it is gone. No database, no message history, nothing to breach later.

Getting the security model right took real, unglamorous work. Every session needs strict authorization checks so one connection can't act on a session it doesn't own. Rate limiting has to apply per message, not just per connection, or a single open socket becomes a flood vector. The CSP has to use per-request nonces instead of leaning on 'unsafe-inline'. The WebSocket layer needs origin validation. None of this is exciting to build, but skipping it is exactly how small tools become the reason someone's data leaks.

Version two added file and image sharing on top of text which introduced its own problem. Since files never touch my server either, I can't run traditional malware scanning without breaking the entire premise of the tool. Instead, I built a strict allowlist of safe file types, verified against each file's actual binary signature (not just trusting the filename, since renaming a script to look like a photo is trivial), enforced size limits, and made sure nothing ever auto-opens or auto-executes on arrival.

AmanMaps is a small tool solving a small annoyance. But I wanted to hold it to the same bar I'd hold client work to properly hosted, properly secured, properly tested rather than let 'it's just a side project' be an excuse to cut corners. It's live now at amanmaps.com, and I'd genuinely welcome feedback from anyone who wants to poke at the security side of it.