Just the file
The minimum viable Trove. One Python script. Drop it anywhere. Run it.
Download faveat_trove.py
Drop one file. Browse a folder.
That's it.
Trove is a single Python file you drop into any folder. Friends on your local network browse and download from any web browser — no apps, no accounts, no cloud, no telemetry. Stdlib only.
Why this exists
Sharing files shouldn't require an account.
Your friend has a phone full of photos. You want to keep a few. The path between those two facts has somehow become an absurdity.
The options are all wrong. Upload everything to someone else's server, then download. Plug in a cable, hope the OS cooperates, dig through DCIM/Camera. Run a third-party "file manager" that wants permission to read every byte on the device, then asks to share more than you meant to share.
Trove is the missing tool: one file you drop into the folder you want to share. Run it. Read off the URL. Your friend taps it on their phone, sees the folder in their browser, picks what they want. The server stops when you press Ctrl-C. No accounts were created. No data left the network.
It's the way LAN file sharing should have always been.
v0.1 — Read-only file sharing for the local network. Zero external dependencies. 150-test security suite. Single file you can audit in an afternoon.
— state of the project, May 2026
How it works
Four steps. No setup.
There's nothing to configure. The folder you launch from is the folder you share. That's the whole mental model.
1
Drop it in
Put faveat_trove.py in the folder you want to share.
2
Run it
One command, in that folder.
python3 faveat_trove.py
3
Share the URL
Trove prints a URL with an auth token (and a QR code for phones).
4
They browse
Friend opens the link. Browses, previews, downloads. Done.
Why it matters
Built like a tool, not a service.
- It's local. The server listens on your local network — bytes go straight from your disk to the visitor's browser, no third party in between.
- It's auditable. One Python file, ~170 KB. Read the whole thing in an evening. No vendored dependencies, no node_modules, no surprises.
- It's read-only. Visitors can browse, preview, and download. They cannot upload, modify, or delete anything. By design, not by configuration.
- It's stateless. Stop the server, the share is gone. No accounts, no databases, no log files left on disk.
- It's portable. Stdlib only. Runs on Linux, macOS, Windows, and Android (via Termux). No installer, no package manager.
- It's free. GPLv3+ source. Use it, modify it, share it. Forever.
Features
Small surface area. Sharp execution.
Trove does one thing — let your friends browse a folder over the network — and tries to do every part of that thing well.
Three views
Grid, list, and details (with sortable columns). Choose what fits.
Search
Full-text with prefix-match boost, accent-insensitive, copper highlights.
Lightbox
In-browser preview for images, audio, video, PDFs, and text.
Multi-select + zip
Pick the files you want. Trove zips and streams them.
HTTPS support
Pass --cert + --key. mkcert workflow documented.
Auth tokens
192-bit CSPRNG. HttpOnly cookie after first hit. Identical 401s.
QR code
Pure-Python encoder. Scan from a phone — no typing tokens.
Themes + keyboard
Dark, light, full keyboard navigation, in-browser help modal.
Privacy commitment
Privacy by architecture.
Trove can't leak data because the architecture doesn't allow for it. There is no telemetry, because there is no network code that calls home. There is no cloud, because there is no server but yours.
- Read-only by design. Trove cannot upload, modify, or delete any file. The server has no filesystem write paths.
- Local network by default. The server is reachable from your LAN. On a typical home setup behind NAT the public internet can't reach it. Pass
--bind 127.0.0.1to restrict to this machine only. - No telemetry, no CDNs, no external requests. The page makes zero outbound calls. Auditable by reading the source.
- No accounts. Authentication is a per-session token, generated at startup and discarded at shutdown. Nothing to "create."
- No third parties. Stdlib only. No vendored libraries phoning home, no analytics, no error reporting.
- Source-available. GPLv3+. Read it, modify it, audit it, share it. Forever.
Get Trove
Two paths in. Both free.
Trove is one file. Download it directly, or clone the full repo with tests, README, and brand assets.
The whole workshop
Source, 150-test security suite, README with mkcert / Termux / HTTPS guides, brand assets.
Open on Codeberg →Stand on the shoulders