## About Wispers Access
Wispers Access makes it easy to share a web app with your coworkers, friends, or
family without having to publish it to the internet. Guests install the Wispers
Access app, scan a QR code, and then simply browse your app. No need to deal
with the complexity and security risk of exposing your app.
A perennial problem with self-hosted software is that it's hard to give people
access to it. Whether it's your company's ERP software, that vibe-coded app your
team likes, or your private photo archive at home, they're not very useful if
people can't reach them. You could put your app on the internet, but that's
increasingly hard to do securely. Anything reachable from the internet gets
probed around the clock, by scripts and by AI agents. VPNs can help, but your
phone can only be on one at a time, and your relatives may not want to set one
up.
Wispers Access solves this by automatically connecting your guests' devices
through secure peer-to-peer channels to the machines running the web apps you
want to share. Internally, the secure connections work like VPN connections, but
because they're at the application level, they never clash, not even with your
existing VPN. All your guests see is an app that magically connects them to your
web app.
No cloud service has access to your app or your traffic. The peer-to-peer
channels are built on [iroh](https://iroh.computer) or on our own [Wispers
Connect](https://connect.wispers.dev). Finding each other (and relaying when no
direct path exists) still needs rendezvous servers in the cloud, but those
servers are cryptographically unable to eavesdrop on your traffic or to inject
malicious nodes.
## Project status
Wispers Access is currently in open beta.
Guests can find the apps (plus an installation guide) at
[access.wispers.dev](https://access.wispers.dev). Direct links:
* Android: [Play Store](https://play.google.com/store/apps/details?id=dev.wispers.access.android).
* iOS: [TestFlight](https://testflight.apple.com/join/AjsJChhq), until App Store review is through.
* Desktop (macOS, Windows, Linux): [GitHub releases](https://github.com/s-te-ch/wispers-access/releases?q=%22Wispers+Access+desktop%22).
Instructions for setting up the server are in the quick start section below.
## Quick start
To get a first taste without installing anything on a server, grab a live invite
code at [access-demo.wispers.dev](https://access-demo.wispers.dev) and jump
straight to [step 4](#4-open-it-on-a-phone).
But you'll really want to share your _own_ app. To do this, you need `waserver`
on a machine next to the app you want to share, and a client on each guest
device.
### 1. Install waserver
On Linux or macOS:
```sh
curl -fsSL https://raw.githubusercontent.com/s-te-ch/wispers-access/main/install.sh | sh
```
This puts the newest `waserver` and `waclient` into `/usr/local/bin`. You can
also just download the binaries from the [releases
page](https://github.com/s-te-ch/wispers-access/releases). Or if you prefer
containers, follow the quick start in the [container
README](waserver/docker/README.md) instead. There's also a [hosting
guide](docs/hosting.md) and the [FAQ](docs/faq.md).
### 2. Share your app
Say the app you want to share is listening on port 3000 (for apps that use
several ports or origins, see [Apps on several
origins](docs/hosting.md#apps-on-several-origins)). Then,
```sh
waserver init team "Awesome Team"
```
This creates a *share* for your team and prints the path of its `share.toml`.
Add the app to that TOML file (`waserver edit team` opens the file in your
editor):
```toml
[[app]]
id = "myapp"
name = "My App"
upstream = ":3000" # host:port, or :port for localhost
```
That's the config done. Now serve the share:
```sh
waserver serve team
```
(`waserver start team` runs it in the background instead.) If you later edit
`share.toml`, make sure to apply the changes with `waserver reload team`.
`waserver edit team` does both in one go.
### 3. Invite a device
Next, invite somebody to the share you just created. Invites are minted by the
running server from step 2, so run this in a second terminal (or use `waserver
start team`):
```sh
waserver invite team "Alice's phone" alice@example.com --png invite.png
```
This produces the invite in three different formats: a `wax1_…` invite code to
copy-paste, an ASCII art QR code to scan with the phone, and the same QR code as
a PNG. The user ID (`alice@example.com`) is a label you choose. `waserver` sends
this label to your app with every proxied request, in the
`x-wispers-access-user` header.
### 4. Open it on a phone
If you haven't yet, install a Wispers Access client. Choose Android or iOS from
https://access.wispers.dev. The device you're installing it on does _not_ have
to be on your LAN or VPN.
Open the app, tap **+**, and scan the QR code (or copy-paste the invite code).
The shared app opens right inside Wispers Access.
### … or on a desktop
For desktop (macOS, Windows and Linux), choose a client from
https://access.wispers.dev and install it (the certificate we used to sign the
Windows client is pretty fresh, so SmartScreen may show a warning).
Open the app, click "+ Add a share", paste the invite code (`wax1_...`), click
"Join". When opening a shared app on desktop, your system browser will open a
new tab and show the app there.
Finally, if you'd rather stick to the CLI, there's also
[`waclient`](docs/waclient.md) (installed together with `waserver`). It's useful
for local testing but not something you'd tell your relatives to install =)
## When to use something else
Wispers Access shares web apps with specific, invited people, without having to
publish those apps to the internet. Adjacent use cases may be better served by
other tools. Some examples:
- **ngrok** and friends are the fastest way to put a dev server on a public
URL. If you _want_ the whole internet to reach your app, that's the tool.
- **Cloudflare Tunnel** publishes an app through Cloudflare's edge, with
optional access control in front. Great for public sites and for teams already
on Cloudflare. The trade-off is that Cloudflare terminates TLS and sees your
traffic.
- **Tailscale** and other mesh VPNs connect whole devices into one private
network. If you can get everyone and all their devices onto a single tailnet,
that's a great solution. The Wispers author couldn't, got annoyed, and started
Wispers =)
What sets Wispers Access apart is the trust model: connections are end-to-end
encrypted _and_ membership is verified peer-to-peer, so the rendezvous server
cryptographically cannot read your traffic or sneak a device into your share.
Tunnel providers and mesh-VPN coordination servers have to be trusted on one or
both of these.
## Choosing peer-to-peer transports
Wispers Access includes two distinct libraries for establishing secure
peer-to-peer connections between the host node and the guest nodes, iroh (the
default) and Wispers Connect. You can specify a transport when initialising a
share, with `--transport=iroh` or `--transport=wispers-connect`. If in doubt, go
with iroh. It's quickly becoming a standard for peer-to-peer connectivity.
Wispers Connect is the home-grown version, created before iroh was published.
The upside of Wispers Connect is that we can fix bugs or implement features
ourselves.
## Licensing
Everything you need to run Wispers Access is open source:
- **Wispers Access** (this repo) is [MIT licensed](LICENSE), as are the
underlying [iroh](https://github.com/n0-computer/iroh) (MIT or Apache-2.0)
and [wispers-connect](https://github.com/s-te-ch/wispers-client) libraries.
- **The standalone hub**, [wispers-hub](https://github.com/s-te-ch/wispers-hub),
is AGPL-3.0.
The managed Wispers Connect backend at
[connect.wispers.dev](https://connect.wispers.dev) offers a free personal tier.
