Skip to main content
When two devices cannot reach each other directly, Floe routes the transfer through a relay: a server both devices can reach, which forwards packets between them and cannot read them. A relayed transfer takes a detour, so it is usually slower, and it is capped at 2 GB per session. Think of a courier carrying a locked box. It gets the box where it needs to go and cannot open it. Some networks make a direct path impossible. Strict corporate and university firewalls do it deliberately. Some mobile carriers can do it as a side effect of carrier-grade NAT, which puts many customers behind one shared address. Most mobile data still connects directly. Should you worry when the badge says Relay? No, unless your files total more than 2 GB. The relay cannot read your files. The transfer is usually slower, and the rest of what it costs is under What it costs you.

​
Direct and relayed, side by side

The encryption row is the important one. Relaying changes the route, not the protection. Your files are encrypted before they reach the relay and decrypted only on the other device, so the relay forwards packets it cannot read.

​
What it costs you

Speed, because every byte takes a detour through a third machine instead of going straight across. Size, because relay bandwidth costs real money. Relayed transfers are capped at 2 GB per session. See File size limits. A little more metadata exposure. Metadata here means facts about the transfer rather than the files themselves. The relay is an endpoint both devices connect to, so it sees the IP address of each device and the timing and size of what it forwards. It cannot see contents. On floe.one the relay is Cloudflare’s Realtime TURN network, which means a relayed transfer does cross infrastructure Floe does not own. See Known limitations.

​
Turning it off, and the opposite

Each app has its own switches for the relay. Turning the relay off means only direct connections are attempted, and the transfer fails if none is possible. Using only the relay hides your IP address from the other person, and caps every transfer at 2 GB while it is on. In the browser, the Network relay fallback checkbox appears on the Send page once you have picked files, and goes away when you click Create secure link, so set it before you click. The receiving page has no such control. If you are receiving and a transfer will not start, this is the sender’s setting to check. In the CLI, --no-relay stops your side offering the relay. The other side can still offer one, as How the route is chosen explains.
Terminal
--relay-only makes the relay the only path, so the other person sees the relay’s address rather than yours. The two flags cannot be combined, and a typed --no-relay wins over FLOE_RELAY_ONLY=1 for that one transfer.
Terminal
Floe Desktop has no relay-fallback switch at all, so the relay is always available there. Its Hide my IP setting, labeled Hide my IP address, is the same control as --relay-only.

​
How the route is chosen, and how Floe knows which it got

This section is the technical detail behind the badge, and you can skip it. In short, the badge reads Relay only when the path the two devices settled on runs through the relay. ICE, the step in which the two devices try the network paths between them, tries the candidate pairs it gathered and nominates, that is picks, one that works. A candidate pair is one address from each device, as Direct connections explains. Traffic is relayed when the nominated pair has a relay candidate on either side. Host and reflexive candidates are still gathered and offered in that case; they simply lost. Turning the relay off removes the relay entries from the address list that side uses, so it has nothing relayed to offer. It does not stop the other side from offering one, and if that path wins, the two surfaces behave differently:
  • The browser notices and blocks the transfer before any file data moves. Its message begins Connection failed. This link was made with Network relay fallback off.
  • The CLI does not: --no-relay is ICE filtering and nothing more. A floe send --no-relay whose peer supplied the winning relay candidate goes ahead over it. Treat the flag as “do not offer a relay” rather than as a guarantee.
The browser re-reads the connection statistics every 5 seconds and flips the badge to amber when the nominated pair is relayed. Floe Desktop and the CLI each read it once, when the connection is established, so their indicators are a snapshot rather than a live reading: the desktop badge, and the CLI’s Connected (direct) or Connected (relay) line. When the CLI cannot read the route it prints Connected alone and carries on. The sender consults the route a second time only to decide whether the size cap applies. On floe.one the signaling server hands out three endpoints and no more: a STUN URL, a TURN URL over UDP, and a TURN URL over TLS on port 443. The last looks like ordinary HTTPS to a network that blocks everything else. Cloudflare offers more variants, but every extra URL multiplies the connectivity checks each client runs during setup, so the list is trimmed before it is served.

​
What a firewall has to allow

A firewall has to let a transfer on floe.one reach these addresses. The CLI and Floe Desktop use a WebSocket on api.floe.one/ws, so a proxy in the way has to allow the WebSocket upgrade. The web app can fall back to ordinary HTTPS requests. A direct connection normally sends UDP straight to the other device, on ports picked for each transfer. Where that is blocked, only the relay can carry the transfer. An app that cannot fetch its connection list from api.floe.one uses Google’s public STUN servers on UDP 19302 instead. They, and the GitHub addresses that installs and updates reach, are listed under Other services floe.one relies on. A self-hosted instance uses its own addresses.
Last modified on October 28, 2026