Transfer Files Without Internet: How Decimen Sends Data Through a Screen and a Camera

 

I saw a headline about moving files with QR codes and no Wi-Fi and assumed it was a gimmick. Then I opened decimen.app, pointed one phone at another laptop screen, and watched a PDF rebuild itself from flashing squares. No cable. No Bluetooth pairing. No shared network. Just light.

The project is called Decimen, built by Evan Crawley (Bash Alarmist). Some articles spell it "Desimon," including a recent piece on Geeky Gadgets. Same idea. The real repo lives at github.com/bashalarmistalt/decimen-optical-transfer, where it has picked up thousands of stars for a reason: it solves a narrow problem very cleanly.

The One-Minute Version

Optical file transfer works like this:

1. Device A encodes a file into a stream of animated QR codes on its screen.
2. Device B points a camera at that screen and decodes each frame.
3. After enough distinct frames arrive, the receiver reconstructs the original file.
4. Nothing travels over Wi-Fi, cellular, USB, or Bluetooth between the two devices.

That last point is the whole pitch. You are not "offline syncing through the cloud." You are literally reading pixels. For air-gapped machines, embedded boards with only a camera, or situations where you do not trust any radio stack, that matters.

Why Fountain Coding Changes Everything

Early QR transfer demos often chopped a file into numbered chunks. Frame 1, frame 2, frame 3. Miss frame 2 and you are stuck waiting for the loop to come back around. In bad lighting, with a cheap camera, or when the screen refresh rate and the camera shutter do not line up, dropped frames are normal.

Decimen uses fountain coding, specifically Luby transform codes (Crawley, 2026; Luby, 2002). Instead of shipping unique sequential slices, the sender emits mathematically mixed frames. The receiver needs roughly K × 1.15 distinct frames, in any order, to peel the file back out. A missed frame slows you down. It does not break correctness.

That design fits the channel. A screen-to-camera link has no back-channel. The sender cannot ask "did you get packet 47?" It can only keep flashing codes and hope the camera catches enough of them. Fountain codes were built for exactly that kind of one-way, lossy pipe.

The same fountain-code idea showed up earlier in Ivan Daniluk's txqr project (Divan, 2018), which is worth reading if you want the theory without the browser polish.

What Decimen Actually Ships

Decimen is not a research slide deck. It is a working web app plus open-source codebase (Crawley, 2026):

• No install required. Open decimen.app on two devices. It can cache for offline use and install as a PWA on iOS and Android.
• Files up to 64 MB, or pasted text, with filename and MIME type preserved.
• SHA-256 verification before download is offered, so you know the rebuild matched the sender.
• Optional gzip when compression helps.
• Export as looping animation (APNG or PNG sequence), so a recorded video of the QR stream can be decoded later by any camera pointed at playback.
• Twelve UI languages, with RTL layout where needed.

Important caveat straight from the README: neither mode is encrypted. Anyone with line of sight to the screen can read what is flashing. Decimen gives you isolation from networks, not secrecy from nearby eyes. Treat it like shouting a file across a room, not like end-to-end encryption.

How Fast Is It, Really?

When Geeky Gadgets covered the project, they cited roughly 128 KB/s as a practical ceiling (Horsey, 2026). That matched early impressions. The project has moved since then. Crawley publishes benchmark "receipts" in the repo, and the current records (August 2026, v0.4.0) look like this:

Device pair	Sustained	Peak	1 MB transfer
Desktop monitor to iPhone	418.5 KB/s	601.5 KB/s	2.5 s
Phone to phone	199.2 KB/s	340.8 KB/s	5.1 s

Those numbers are goodput for the whole transfer, not a cherry-picked burst. Still not USB territory. A 10 MB config bundle might take half a minute phone-to-phone. But for logs, keys, firmware patches, or a short video clip into an air-gapped box, that is often fine.

What moves the needle:

• Screen size and brightness. A large, bright panel (the record run used a 49-inch Odyssey G9) gives the camera more pixels per module.
• Camera quality. Better optics resolve denser QR modules, which means more bytes per frame.
• Distance and alignment. Keep the camera square to the screen and close enough that modules stay sharp.
• Refresh vs shutter. LCD ghosting and frame-rate mismatch still cause drops. Fountain coding absorbs the drops, but you pay in time.

Decimen vs LiveDrop and the Rest

Decimen is open source and browser-native. LiveDrop, covered by PetaPixel (Kritsonis, 2025), is a Dutch commercial product chasing the same optical channel with a mobile app and SDK. Both flash dynamic QR-like codes. Both work without Wi-Fi or Bluetooth between devices. The differences are mostly product shape and tuning.

Project	Access	Reported speed	Notes
Decimen	Free web app + AGPL source	Up to ~419 KB/s sustained (published benchmarks)	Fountain codes, SHA-256 check, 64 MB cap, no account
LiveDrop	iOS/Android app, paid Windows tier, SDK	~700 kbps in 2025; testing 2.6 Mbps	Long-range optics (hundreds of meters with telephoto lenses), optional encryption keys
txqr	Open source (Go)	Varies by setup	Early animated QR + fountain code reference implementation
libcimbar	Open source	Higher density than QR	Custom color barcode instead of standard QR modules

LiveDrop's team talks openly about optics as the bottleneck (Kritsonis, 2025). Phone cameras with wide apertures work well at short range. A 600 mm lens on a proper camera body can stretch the link to hundreds of meters. They are also experimenting with grey/blue tones and infrared for night transfers. Decimen stays pragmatic: standard QR modules, browser decoder built on ZXing, and reproducible benchmark JSON in the repo so skeptics can verify claims.

Crawley notes similar ideas arrived independently elsewhere, including airgapped-qr-code-transfer, which uses sequential chunking instead of fountain frames. Convergent evolution, not copying.

Where This Actually Gets Used

Most people will never need optical transfer. For the cases that do, it is oddly elegant:

• Air-gapped systems. Push a patch or config onto a machine that never touches a network. The data path is visible light only.
• Embedded and industrial gear. A laptop screen facing a controller with a camera module, no USB port exposed.
• Remote or disconnected sites. Two laptops on a worksite with no router. Still faster than retyping hex.
• Cross-platform friction. No Apple/Google ecosystem negotiation. If it has a browser and a camera, it can receive.
• Pre-recorded drops. Export the QR animation, play it on a monitor in a lab video, and let receivers decode from the recording.

Geeky Gadgets frames the security angle as keeping data off external networks (Horsey, 2026). That is fair, with one correction: optical transfer is not automatically "secure." It is network-isolated. Shoulder surfers, cameras in the room, and recorded screens are all in scope.

Practical Tips If You Try It Today

I am not going to pretend setup is zero-friction. It is simple, not magic.

1. Open decimen.app/send/ on the sending device and load your file.
2. Open the receive page on the other device and grant camera access.
3. Maximize brightness, kill night mode, and reduce glare if you can.
4. Hold the receiver steady. Let the progress bar climb. Fountain coding means stutters are fine; giving up early is not.
5. Wait for the SHA-256 check before saving.

Developers can clone the repo, run npm install and npm run dev, and hit the local HTTPS server from a phone on the same LAN for testing (Crawley, 2026). There is also a npm run benchmark path if you want to publish your own receipt.

Limits Worth Knowing Up Front

Optical transfer is a specialty tool, not a replacement for AirDrop or a cable:

• Speed caps. Even hundreds of KB/s is tiny next to gigabit Ethernet.
• No encryption by default. Decimen is explicit about this. LiveDrop can layer access keys, but the channel is still visible.
• Hardware tuning. Ghosting on LCD panels, rolling shutter, and autofocus hunting all eat frames.
• Line of sight. Obstructions and glare are failure modes, not edge cases.
• Human patience. Large media works in theory (64 MB). In practice you will choose smaller files unless you are committed.

That is the honest trade. You gain a data diode made of photons. You lose bandwidth and confidentiality unless you add other layers.

Decimen turns a screen and a camera into a one-way file pipe with no network stack in the middle. Fountain coding is the reason it survives real-world frame drops. LiveDrop pushes the same idea toward commercial speed and long-range optics. Both sit in a growing family of optical exfiltration and sideload tools that sound like spy fiction until you need them on a factory floor.

If you have ten minutes and two devices, try the live demo. Watching a file materialize from blinking QR codes is the fastest way to decide whether this belongs in your toolkit or stays a neat party trick. For me, it crossed from gimmick to "oh, I would use this on an air-gapped laptop" somewhere around the first successful SHA-256 match.

Bibilography

• Crawley, E. (2026). Decimen optical transfer: Fountain-coded QR file transfer [Computer software]. GitHub. https://github.com/bashalarmistalt/decimen-optical-transfer
• Divan. (2018). txqr [Computer software]. GitHub. https://github.com/divan/txqr
• Horsey, J. (2026, August 12). Transfer files without internet using optical QR codes. Geeky Gadgets. https://www.geeky-gadgets.com/transfer-files-without-internet/
• Kritsonis, T. (2025, March 9). LiveDrop wirelessly moves data using dynamic QR codes and cameras. PetaPixel. https://petapixel.com/2025/03/09/livedrop-wirelessly-moves-data-using-dynamic-qr-codes-and-cameras/
• Luby, M. (2002). LT codes. In Proceedings of the 43rd Annual IEEE Symposium on Foundations of Computer Science (pp. 271-280). IEEE.

Read More

The Future of AI Ethics: Balancing Innovation and Privacy

What does it mean to balance innovation and privacy?

It’s a digital paradox. Artificial Intelligence (AI) is evolving at a breakneck pace, transforming industries from healthcare to finance. Yet with every stride forward, it edges closer to a critical boundary—the fine line between innovation and our fundamental right to privacy.

As a full-stack developer, I see this tension every day. We design systems to be functional, fast, and intuitive. But behind that sleek interface lies a deeper challenge: the data that fuels AI, where it comes from, and how responsibly it is handled.

AI’s hunger for data is insatiable. The more data a model consumes, the smarter it becomes. But what happens when that data includes our most personal information, our medical records, search history, or even biometric details? How do we protect our digital footprint from being used in ways we never intended?

The Privacy Problem

The current state of AI and privacy is a delicate dance—one that often leans in favor of the algorithms rather than individuals. AI systems, particularly large language models (LLMs) and predictive analytics, are trained on vast datasets scraped from the internet. This creates several risks:

• Data Memorization and Exposure: Models can inadvertently memorize and regurgitate sensitive information, such as personal emails or addresses. This risk is amplified in healthcare and finance, where confidentiality is paramount.

• Algorithmic Bias: AI reflects the data it’s trained on. When datasets are biased, outcomes are biased too. We've seen facial recognition systems misidentify people of color, and hiring algorithms discriminate against women. This isn’t just about privacy—it’s about fairness and social justice.

• Lack of Consent: Many datasets are built without explicit consent from the individuals whose data is used. This raises pressing legal and ethical questions about ownership, autonomy, and digital rights.

These aren’t abstract issues. They translate into wrongful arrests, unfair financial profiling, and systemic discrimination. The need for stronger ethical and regulatory frameworks has never been clearer.

A Path Forward: Building Responsible AI

Balancing AI’s potential with the imperative of privacy demands a multi-pronged approach that blends technology, policy, and culture.

1. Privacy-Enhancing Technologies (PETs)

• Federated Learning: Train models across decentralized devices so raw data never leaves its source.

• Differential Privacy: Introduce noise into datasets to protect individual identities while still enabling useful analysis.

• Encryption Everywhere: Secure data both in transit and at rest to reduce exposure risk.

2. Ethical Frameworks and Regulation

• Transparency: Make AI systems explainable. Users deserve to know not just what a model decides, but why.

• Accountability: Clearly define responsibility when AI systems cause harm—whether it falls on developers, deployers, or regulators.

• Data Minimization: Only collect what is necessary for a defined purpose—no more, no less.

3. Building a Culture of Responsibility

• Diverse Teams: Encourage inclusivity in development teams to detect and address bias early.

• Ethical Audits: Regular, independent evaluations to check for bias, privacy leaks, and misuse.

• User Control: Empower users with more granular control over their data and how it’s used in AI systems.

Public LLMs and the Privacy Challenge

Public Large Language Models (LLMs) bring extraordinary opportunities—and extraordinary risks. Their data sources are broad and often unfiltered, making privacy protection a pressing challenge.

Key Measures for LLMs:

• Data Minimization and Anonymization: Actively filter out sensitive data (PII) during training. Apply anonymization techniques to make re-identification impossible. Offer opt-out mechanisms so individuals can exclude their data from training sets.

• Technical Safeguards (PETs): Use federated learning to keep raw data decentralized. Apply differential privacy to prevent data leakage. Ensure input validation so users can’t accidentally inject sensitive data into prompts.

• Transparent Governance: Publish transparency reports explaining what data is collected and how it’s used. Conduct independent audits to detect bias, leaks, or harmful outputs. Provide clear privacy policies written in plain language, not legal jargon.

• Regulatory & Policy Actions: Introduce AI-specific legislation covering data scraping, liability, and a digital “right to be forgotten.” Promote international cooperation for consistent global standards.

How Companies Collect Data for AI and LLM Training

The power of AI comes from the enormous datasets used to train it. But behind this lies a complex ecosystem of data collection methods, some transparent, others controversial.

Web Scraping and Public Data Harvesting: Most LLMs are trained on publicly available internet data like blogs, articles, forums, and social media posts. Automated crawlers “scrape” this content to build massive datasets. While legal in many contexts, ethical questions remain: did the original authors consent to their work being used in this way?

Example: GitHub repositories were scraped to train coding AIs, sparking lawsuits from developers who argued their work was used without consent or attribution.

User-Generated Data from Platforms and Apps: Consumer-facing apps often leverage user interactions like search queries, chatbot conversations, voice assistant recordings, and even uploaded photos. These interactions directly feed into improving AI models.

Third-Party Data Brokers: Some companies purchase vast datasets from brokers that aggregate browsing history, purchase patterns, and demographic data. While usually anonymized, the risk of re-identification remains high.

Consumer Products and IoT Devices: Smart speakers, wearables, and connected home devices capture biometric and behavioral data from sleep cycles to location tracking—often used to train AI in health and lifestyle domains.

Human Feedback Loops (RLHF): Reinforcement Learning with Human Feedback involves users rating or correcting AI responses. These interactions are aggregated to fine-tune models like GPT.

Shadow Data Collection: Less visible forms of data collection include keystroke logging, metadata tracking, and behavioral monitoring. Even anonymized, this data can reveal sensitive patterns about individuals.

Emerging Alternatives: Ethical Data Practices

To counter these concerns, companies and researchers are experimenting with safer, more responsible methods:

• Synthetic Data: Artificially generated datasets that simulate real-world patterns without exposing actual personal details.

• Federated Learning: Keeping raw data on user devices and aggregating only learned patterns.

• User Compensation Models: Exploring ways to reward or pay users whose data contributes to AI training.

Innovation with Integrity

The future of AI isn’t just about building smarter machines, it’s about building systems society can trust. Innovation cannot come at the expense of privacy, fairness, or autonomy.

By embedding privacy-enhancing technologies, enforcing ethical frameworks, and fostering a culture of responsibility, we can strike the right balance.

AI has the power to revolutionize our world but only if it serves humanity, not the other way around. The real question isn’t how fast AI can advance, but how responsibly we choose to guide it.

Bibliography

• Floridi, L. & Cowls, J. (2022). A Unified Framework of Five Principles for AI in Society. Harvard Data Science Review.
• European Union. (2018). General Data Protection Regulation (GDPR). Retrieved from https://gdpr-info.eu
• Brundage, M. et al. (2023). Toward Trustworthy AI Development: Mechanisms for Supporting Verifiable Claims. Partnership on AI.
• Cybersecurity & Infrastructure Security Agency (CISA). Privacy and AI Security Practices. Retrieved from https://www.cisa.gov
• IBM Security. (2024). Cost of a Data Breach Report. Retrieved from https://www.ibm.com/reports/data-breach
• OpenAI. (2023). Our Approach to Alignment Research. Retrieved from https://openai.com/research

Read More