CASE STUDY

YandFTP

Android App • Storage Gateway

Project Overview

An Android phone becomes a full multi-protocol file server — FTP, FTPS, web portal, Windows network drive and media source — with nothing to install on the computer.

Context & Challenge

Moving files off a phone still means a cable, a cloud account, or an app installed on both ends. The alternatives each expose exactly one protocol, so the phone works with one kind of client and nothing else — and anything that goes through a cloud service leaves the local network to come back to a machine two metres away.

Client Objectives

• Expose the same storage through every protocol a desktop, a TV or a file manager already speaks
• Require nothing to be installed on the computer
• Make an encrypted connection the normal case, not an advanced setting
• Keep every byte on the local network: no account, no third-party server, no telemetry

UX Research & Architecture

The barrier was never the transfer, it was the connection: typing an IP address, a port, a username and a password on a computer to reach a phone. "QR connect" replaces all of it — scan, and the browser opens already authenticated. The code carries an opaque token valid for five minutes and consumed on first use, not the password, so photographing the screen afterwards grants nothing. Lending access to someone else goes through a temporary guest account with a random secret, a visible countdown, and revocation in one gesture.

UI Design & Design System

A dashboard, not a control panel: one tap starts all five endpoints, and the state of each is legible at a glance. The web portal is a real file manager rather than a list of links — folder navigation, grid or list, photo and video thumbnails, a full-screen viewer, in-page playback with instant seeking even on a multi-gigabyte file, accent- and case-insensitive search across the whole storage, type filters, drag-and-drop upload with progress, and a whole folder downloaded as a ZIP built on the fly.

Development & Technologies

Zero-copy transfers: sendfile() lets the kernel move pages from storage to the Wi-Fi card without passing through the VM heap. ZIP compression streams, so the download starts immediately with no temporary archive and no size limit, and already-compressed media is stored rather than pointlessly recompressed. A RAM directory cache makes the second visit to a folder of thousands of files instant. Resumable and segmented downloads via FTP REST and HTTP Range. CPU and high-performance Wi-Fi locks keep transfers running with the screen off and the app closed.

Tech Stack: Java 11, Android SDK 26–35, hand-written FTP/FTPS/HTTP/WebDAV/DLNA stacks, TLS 1.3 with an on-device X.509 v3 generator, PBKDF2-HMAC-SHA256

Results & Business Value

• Five protocols served simultaneously from one storage, under one authentication and permission model
• TLS 1.3 on both the control and data channels, with the certificate's SHA-256 fingerprint shown in the app so a client can verify it is talking to the phone and not to a machine in between
• Passwords derived with PBKDF2-HMAC-SHA256 at 120,000 iterations and a 16-byte random salt — never stored in clear, never backed up to a cloud, never transferred between devices
• Remote deletion is reversible: DELE, RMD and the portal's delete button land in a restorable bin that returns a file to its exact original location
• 241 automated tests, including end-to-end tests where a real client talks to a real server over real sockets
• ~6 MB release APK, no third-party networking dependency, no telemetry, no account, no advertising

How this was measured: 241 automated tests ship with the release, including end-to-end tests in which a real client speaks to a real server over real sockets. Everything claimed above is a documented behaviour of version 2.1.0, not a projection.

What it does not do

• SFTP over SSH is not implemented — it needs a complete SSH-2 stack. For an encrypted channel, use FTPS or HTTPS.
• SMB/Samba is not implemented. WebDAV covers the same use on Windows, macOS and Linux.
• Search covers names, paths, types and metadata. Content analysis (OCR on photos, text inside PDFs) is not included.
• No automatic two-way sync: that would require an agent installed on the computer.
• No Chromecast. Casting to televisions goes through DLNA, which most TVs recognise natively.
• The certificate is self-signed, so browsers and FTPS clients warn on first connection — no public authority can certify a 192.168.x.x address. The fingerprint shown in the app is there to settle the doubt.

Inside the product