Skip to main content
floe receive
Joins a transfer as the receiver, from the sender’s room code or link, and saves no file until you have accepted the whole batch.

​
The short version

Run floe receive, part of Floe’s CLI, with the room code or the link the sender gave you. Files are saved in the folder you run it from, or in the one you name with -o. Check what is coming, then press Enter to accept or type n to decline. Each file takes its own name only once it has arrived whole and passed its checks.

​
Examples

Receive with a room code (for example olive-tiger-castle; capitalization does not matter):
Terminal
Receive with the sender’s full link:
Terminal
Keep the quotes: the & would otherwise end the command. See Put the link in quotes. Save to a specific directory:
Terminal
Accept without a confirmation prompt:
Terminal
Paste a link the way you were given it. It also works without https://, inside <...> or quotes as a mail program or chat app may wrap it, and in the older #room= and ?room= forms. A code is one to four words joined by hyphens. A link you pass here is on your command line, link key included. Your shell keeps it in its history, and while the command runs, other users of the same computer can see it in the list of running processes. Anything that held the whole link can pass the check: see What the link key cannot see. A room code is good for one receiver and for at most 10 minutes: see how long a code and a link last. When a code or a link is turned down, look the message up under On the command line. A code typed with underscores between its words is refused before Floe asks the server, for example Error: could not resolve "olive_tiger_castle": code not recognized: a code is words joined by hyphens, like olive-tiger-castle.

​
Output

Running floe receive olive-tiger-castle -o ~/Downloads:
Output
With no -o flag, files save to the current directory, the folder your terminal is in when you run the command. Saved to always prints the full path. The Connected line says which way the files travel: (direct) when the two devices reach each other, (relay) when they go through the relay, a server that passes the encrypted data along. It reads Connected alone only when the route could not be read, and the transfer goes ahead either way. The Incoming row shows the count and total size, or the file’s name and size when there is only one file. The Verified row appears only when the sender sent a SHA-256, a fingerprint of the file’s contents, with every file, and each one matched as it was written. See File checks for what is checked and when the row is missing. Time counts from your answer at the prompt, so the time you took to decide is in neither the time nor the average speed. In floe 1.11.0 and earlier it counted from the sender’s first announcement. When the sender runs a different Floe release from yours, one extra line above the Incoming box names it, for example Peer version: desktop-v1.1.0. A browser sends no version, so the line never appears for one. Versions do not need to match. floe receive 1.12 and later checks a link that holds a link key. It sends its own proof, and shows no prompt and saves nothing until the sender has proved it holds the same link key. A sender that cannot prove it ends the receive with one line, with no Error: in front:
Output
A sender that connects and says nothing ends it after 30 seconds, with connected, but no data arrived from the sender within 30s. floe 1.7.5 to 1.11.7 read the room id and ignore the link key, and 1.6.0 and older cannot read such a link. A room code and a link from an older Floe hold no link key, so a receive of either has no check, on any version. See What the link key checks.

​
Confirmation prompt

When the sender announces the first file, Floe shows what is incoming and asks once, for the whole batch:
Output
For two or more files the box shows only their count and total size. Each file’s name appears on its progress line as it arrives.
  • Type n or no, in any capitalization, to decline. Nothing is saved, the sender is told that you declined, and floe receive ends with Error: transfer declined. (floe 1.11.0 and earlier close the connection without telling the sender why.)
  • Press Enter or type anything else to accept and begin receiving. The prompt only looks for a decline, so a typo counts as yes.
  • An empty answer accepts as well, and that is what a closed or piped stdin gives, meaning input a script passes in or no input at all: echo | floe receive <code> receives without -y. See In scripts and CI.
The sender waits 120 seconds for your answer. After that its side gives up, and a floe send there ends with timed out waiting for ack. Your prompt keeps waiting: when you answer, floe receive ends with Error: the sender left before the transfer was accepted and creates nothing. The same happens when the sender stops while you decide. Pass -y to skip this prompt and accept automatically.

​
How files are saved

Received files land in the output directory. When the sender sent a folder, its structure is kept: each file arrives at the same relative path inside your output directory.

​
Nothing is overwritten

If a name is already taken, the incoming file is saved with a number before the last dot: report.pdf, then report (1).pdf, and archive.tar.gz, then archive.tar (1).gz. A name whose only dot is its first character, such as .env, has no extension, so the number goes at its end: .env (1). The progress line shows the name actually written. If another program takes that name while the file is still arriving, the file is saved under the next number instead, and floe receive says so on a line such as Saved as report (2).pdf.

​
Files are written as .part first

Each file is written under a temporary name ending in .part (a .part file). It takes its final name only once it has passed the size check and, when the sender sent a SHA-256, the SHA-256 check (see File checks). A file that fails either check is deleted and the transfer stops, so nothing half-written can ever sit under a finished-looking name. A transfer that fails or stalls partway deletes its .part file. Files that completed earlier in the batch are kept, and a retry reuses the original name instead of a numbered one. If the process is killed outright or the machine loses power, the worst leftover is a .part file, which is safe to delete. Until you delete it, a retry saves under a numbered name. On macOS and Linux, a crash at the exact moment a file is completed can also leave an empty file under the final name, beside a whole .part file. Delete the empty one, and remove .part from the other’s name. On Windows the final rename is a single step, so this cannot happen. One .part file is worth keeping. floe receive can end with this line:
Output
That file arrived whole and passed its checks, but it could not be renamed, usually because an antivirus scanner or an indexer was holding it. Remove the .part ending by hand to get the file.

​
Names are adjusted to what your system can store

A name your system cannot represent is adjusted before the file is written, and the progress line shows the adjusted name.
  • On Windows, the characters < > : " | ? * become underscores, trailing dots and spaces are removed, and a name that is exactly a reserved device name (such as NUL) gets an underscore in front. Two names that differed only in one of those characters therefore arrive as a name and its numbered twin. On Windows 10, a name that begins with a reserved device name and a dot, such as aux.h, also gets an underscore in front (_aux.h); Windows 11 keeps it as it is.
  • Also on Windows, one colon is dropped, not replaced. A file or top-level folder whose name begins with any one ASCII character (a letter A to Z, a digit, or a sign such as _) and then a colon loses those two characters, because that start reads as a drive name. For example, P:L 2025.xlsx is saved as L 2025.xlsx, and _:notes.txt as notes.txt.
  • Also on Windows, a backslash, which macOS and Linux allow in a name, separates folders: back\slash.txt arrives as slash.txt in a folder named back. A leading one is dropped when the rest of the name has no other slash or backslash, so \notes.txt arrives as notes.txt.
  • On macOS and Linux, all of those are valid, and names are left exactly as sent.
  • On every platform, a name that starts at a drive or a root, such as C:\notes.txt, /notes.txt or \back\slash.txt, is refused: see Paths that are too deep or too long.
  • On every platform, control characters and text-direction marks are replaced with underscores, since a file name is not a place for either. A browser receiver strips them instead of replacing them, so the same file can land under slightly different names on the two surfaces.
  • On every platform, a name with nothing usable left in it (empty, or only ., .. and separators) is saved as received_file.
The name shown in the Incoming box is cleaned the same way and shortened to 200 characters with its extension kept, so a name cannot rewrite the prompt or disguise its extension before you answer. See Known limitations.

​
Windows marks the files as downloads

On Windows, Floe treats every received file as a download: Windows may warn before it runs a program from one, and Office opens one in Protected View. Floe does this by adding the mark of the web (a hidden note attached to the file, called a Zone.Identifier stream), which SmartScreen and Office read. Not every drive can keep the mark: see where it is and is not kept. On macOS and Linux, floe receive adds no download mark of any kind, the macOS quarantine flag included. Floe does not scan files for malware on any system. A file that passes its checks arrived intact, which does not make it safe to open and says nothing about who sent it. See Known limitations.

​
Paths that are too deep or too long

Before anything is written, floe receive checks where each file would go. It refuses a file whose path inside the transfer:
  • is more than 32 levels deep (31 folders and the file);
  • is longer than 235 UTF-16 code units, the unit Windows counts names in, which is 235 characters for most names and fewer when the names use emoji or some other scripts;
  • starts at a drive or a root instead of inside the output directory.
It stops with:
Output
The sender is told why, and files saved before that file are kept. When the first file is the one refused, that happens before the Accept? prompt, and nothing is saved. A path long enough to make the file’s description longer than 1,000 bytes stops one step earlier, with Error: rejected the sender's control message: 1204 bytes, limit 1000 and the real size in place of 1204. The fix is the same: zip deeply nested folders before sending. A USB stick or memory card formatted as FAT32 cannot hold a file of 4 GB or more. On Windows, floe receive refuses a file too large for the output drive’s file system in the same way, with Error: receive stopped: a file is larger than the save drive can hold. A size that is not a possible byte count is refused before anything is written as well. The path limits apply to every receive, on every platform, and no flag turns them off. floe 1.10.11 and earlier tried to save such paths. A sender can still get the files across by zipping deeply nested folders first. Floe Desktop holds a drop through a request link to stricter rules on top of these, listed under the request link Limits. floe receive applies none of them. Each of these stops before any network call with one line, which has no Error: in front and never repeats the link back, and floe exits with status 1: To send through a request link, see Sending through a request link for a browser, or Send through a request link for floe send --to. floe receive never takes the server from a link, and joining hands the link’s room to the server in effect, so the link and the server have to match. See Use a self-hosted server.

​
Stopping with Ctrl+C

Press Ctrl+C to cancel at any time. floe receive prints Canceled., removes the .part file it was writing, and exits with status 130. Files that finished before that stay. If closing the .part file stalls, floe exits after 5 seconds anyway and leaves it, and it is safe to delete. A second Ctrl+C during those seconds does nothing. On macOS and Linux, a hangup works like Ctrl+C. Closing the terminal, losing the SSH session, or sending SIGHUP prints Canceled., exits with status 130 and tells the sender. floe 1.11.7 and earlier stop at once on a hangup, tell the sender nothing and leave the .part file. A floe receive started under nohup ignores the hangup and keeps going. Once the two sides are connected, the sender is told you stopped: a floe send 1.11.0 or later ends with Error: They stopped the transfer. Once the summary box has printed, the receive is done, and Ctrl+C has nothing left to cancel. floe receive then stops waiting for the sender, prints nothing more, exits with status 0, and sends its byte count unless you opted out. In floe 1.11.0 and earlier, that Ctrl+C printed Canceled., exited with status 130 and sent no byte count.

​
The byte-count report

After a completed transfer, floe receive posts the total byte count, and nothing else, to the signaling server for the public transfer counter. A transfer of only empty files sends nothing. Pass --no-report or set FLOE_NO_STATS=1, and no report is sent. See Opting out of the global counter.

​
Flags

An -o that cannot be created, because a file has that name or the folder above it is read-only, stops at once with Error: cannot create output directory and the reason, while the code still works. floe 1.11.0 and earlier created the folder before connecting. A folder that exists but that you cannot write to passes that check and fails at the first file, after you accepted, with Error: write error: could not finish writing a file, so it was not kept. When no network interface matches any --iface name, floe receive also stops at once, while the code still works, with Error: --iface matches no network interface on this computer; check the name, or drop the flag. floe 1.11.7 and earlier accept any name, and the connection fails after pairing. See CLI flags reference for the global flags that matter here (--server, --no-relay, --relay-only, --iface).
Last modified on November 5, 2026