Just you
storefront.localhostWorks in any Chromium browser with nothing to set up. For curl, Node
and Postman, beamit hosts writes the entries.
Dev servers, addressed
Every dev server on your PC gets a real address instead of a number you didn't choose. The name follows the newest server on each project, whatever port it grabbed.
No --host flag, no hunting for your IP address, and no
testing the instance you forgot to kill.
Three switches
Wi-Fi and the public link are independent, not a ladder you climb. Choosing the key-protected option never switches on the unprotected one, which matters on a café network.
Works in any Chromium browser with nothing to set up. For curl, Node
and Postman, beamit hosts writes the entries.
Point your camera at the QR code and the dev server opens. A stable port per project, so the address survives a restart.
Who can open it: anyone on the network, no keyA permanent HTTPS address that only opens with its key. It is the same address tomorrow, and the same one after a restart.
Who can open it: whoever holds the keyHow the awkward parts work
The link is gated by a key. What makes it usable is that the key is spent once: it is swapped for a cookie and stripped from the URL, so the address you paste into a chat is not the address that opens it.
Serving preview.acme.com normally means handing your
nameservers to somebody, which for a real business means moving the
email too. Beamit doesn't ask for that.
You add a CNAME and one TXT record at whatever provider you already use. A relay on our own server proves the record is really yours before any certificate is issued, then pipes raw bytes to your machine. Hot reload, WebSockets, streaming and uploads all survive, because nothing in the middle reads them.
Your own address does not replace the one we gave you. A project answers on both at once, with the same key.
Everything that's built
Written with zero runtime dependencies, and shipped as one signed executable that needs no Node.js installed.
name.localhost in any Chromium browser, with no setupbeamit hosts for curl, Node, Postman and anything that isn't a browsername.local through a built-in mDNS responder — iPhone and Mac only; Android has no mDNS resolver and that cannot be fixedbeamit.linkHttpOnly; Secure cookielocalhost:5173beamit.link name that survives a restart — your project's name plus four hex, ten per installpaypal-login.com is refusedbeamit doctor, the checks that replace a support emaillocalhostWhere it actually stands
Most of this has been measured on real hardware against real dev servers rather than assumed. Some of it has not, and pretending otherwise would waste your afternoon.
The whole path, over the real internet. A dev server on a laptop served at a public HTTPS address, the gate intact, the Host header rewritten, and a response written in three chunks 300 ms apart arriving in three chunks 300 ms apart. Nothing buffered it, through our own server or through Cloudflare's edge.
Install, run, uninstall and reinstall. The payload and the installer are both signed and timestamped, and the whole lifecycle completes. Before signing, antivirus removed the binary within ten seconds of setup writing it.
Traffic counting, in production. Counted to the byte on the live relay, without attaching a single handler to the stream.
SmartScreen still warns. Signing is what stops the binary being quarantined. Reputation is a separate thing that accrues over downloads, and an organisation certificate does not skip that queue. Expect a warning on the first run until enough people have installed it.
The Wi-Fi rung on Android.
The port, the firewall and the QR code all work. The
.local name does not, and cannot: Chrome on Android
skips system name resolution. That is why each project gets its own
port.
Updating itself. There is no auto-update. A new version means downloading it again, and this page is where it will be.
macOS and Linux. The scanner is genuinely Windows-specific. Everything above it is not.
Reporting abuse
Beamit hands out addresses under beamit.link to whoever
installs it, and they point at somebody's own machine rather than at
anything we host. If one of them is serving phishing, malware or anything
else it should not be, tell us and we will take the address away.
Include the full address you saw and roughly when. A screenshot helps. We answer abuse reports within two working days.
An address can be withdrawn without the person who holds it being involved, because the name is ours and only the dev server behind it is theirs.