beamitfor Windows

Dev servers, addressed

Stop caring which port
it landed on.

Every dev server on your PC gets a real address instead of a number you didn't choose. The name follows the newest server on each project, whatever port it grabbed.

Download for Windows 1.0.0 · 24 MB · Windows 10 and 11, 64-bit
Signed by i21 GmbH. Nothing to install alongside it.
what's listening → what you type
storefront · vite · :5174 storefront.localhost
dashboard · next dev · :3001 dashboard.localhost
invoice-api · node server.js · :3000 invoice-api.localhost
postgres · docker · :55432 postgres.localhost

No --host flag, no hunting for your IP address, and no testing the instance you forgot to kill.


Three switches

Raise an address exactly as far as you need

Wi-Fi and the public link are independent, not a ladder you climb. Choosing the key-protected option never switches on the unprotected one, which matters on a café network.

This PC

Just you

storefront.localhost

Works in any Chromium browser with nothing to set up. For curl, Node and Postman, beamit hosts writes the entries.

Who can open it: nobody else
Your Wi-Fi

Your phone

192.168.1.36:7784

Point your camera at the QR code and the dev server opens. A stable port per project, so the address survives a restart.

Who can open it: anyone on the network, no key
The internet

Anyone you send it to

storefront-7f3a.beamit.link

A permanent HTTPS address that only opens with its key. It is the same address tomorrow, and the same one after a restart.

Who can open it: whoever holds the key

How the awkward parts work

Two problems worth explaining

A public link that isn't public

The link is gated by a key. What makes it usable is that the key is spent once: it is swapped for a cookie and stripped from the URL, so the address you paste into a chat is not the address that opens it.

404the bare link, naming nothing
302the keyed link, setting the cookie
200the cookie, from then on
404a wrong key, or a wrong cookie

Your own domain, without moving your DNS

Serving preview.acme.com normally means handing your nameservers to somebody, which for a real business means moving the email too. Beamit doesn't ask for that.

You add a CNAME and one TXT record at whatever provider you already use. A relay on our own server proves the record is really yours before any certificate is issued, then pipes raw bytes to your machine. Hot reload, WebSockets, streaming and uploads all survive, because nothing in the middle reads them.

Your own address does not replace the one we gave you. A project answers on both at once, with the same key.


Everything that's built

The inventory

Written with zero runtime dependencies, and shipped as one signed executable that needs no Node.js installed.

Finding your dev servers

  • Scans listening ports continuously — 35 ms warm, and spawns nothing while idle
  • Works out the project name from the command line and folder
  • Reads Docker containers and their published ports
  • Matches an unnameable port against a project on disk that declares it — an env file, a dev script, a compose mapping
  • Sorts into Running, Projects and Background, so Google Drive doesn't sit among your work
  • Ignores ephemeral ports unless they map to something real
  • Rename anything by clicking it, and the name sticks

Addresses

  • name.localhost in any Chromium browser, with no setup
  • beamit hosts for curl, Node, Postman and anything that isn't a browser
  • A stable per-project port on your Wi-Fi, with a QR code
  • name.local through a built-in mDNS responder — iPhone and Mac only; Android has no mDNS resolver and that cannot be fixed
  • A permanent public HTTPS address on beamit.link
  • Asks once per network before sharing on one Windows calls public

Public links

  • Key gate, with the key swapped for an HttpOnly; Secure cookie
  • Host header rewritten, so the dev server sees localhost:5173
  • Raw TCP piping — hot reload, WebSockets, server-sent events, uploads and streaming all pass through unbuffered
  • One hour, eight hours, or no limit at all, and extendable
  • The link is checked by using it, not by trusting the tunnel's output
  • A dead link stays dead, and the address does not change underneath whoever you sent it to

Permanent addresses

  • A beamit.link name that survives a restart — your project's name plus four hex, ten per install
  • Your own domain by CNAME plus a DNS TXT ownership proof
  • One claim covers a whole zone, so every name under it works
  • Proof expires after thirty days, because domains change hands
  • Both addresses serve the same project at the same time

The relay

  • Your machine dials out, so there is no router to configure
  • Certificates obtained on demand, and a wildcard for the names we hand out
  • The ownership check is the security boundary — a fabricated record for paypal-login.com is refused
  • Certificate expiry watched in-process, because every uptime service paywalls that check
  • A 50 GB allowance over a rolling thirty days, shown as a bar, pausing with a page that explains itself
  • Built from bare Ubuntu by one script that is safe to run twice

Managing projects

  • Stop a server, and be told honestly when it had already stopped
  • Start it again — the command and folder are remembered, and it relaunches detached with no console window
  • Open folder, open in VS Code, open a terminal
  • Refuses to act on Windows services, Docker-published ports and Beamit's own processes, showing the reason in place of the button

The app itself

  • A tray icon written in stock PowerShell
  • The dashboard installs as an app — manifest, service worker, icons drawn in code rather than shipped
  • Start with Windows, and firewall rules across every profile from one prompt
  • beamit doctor, the checks that replace a support email
  • A capped log that records crashes and signals, because a background app that disappears silently cannot be diagnosed
  • Only one copy runs at a time; launching it again just opens the dashboard

Staying out of trouble

  • Local by default — nothing leaves the machine until you raise a switch
  • Cross-origin POSTs to the dashboard are refused, because every site you visit can reach localhost
  • A refusal never reveals whether a name exists
  • Your dev servers keep running when you quit

Where it actually stands

The honest part

Most of this has been measured on real hardware against real dev servers rather than assumed. Some of it has not, and pretending otherwise would waste your afternoon.

Proven

The whole path, over the real internet. A dev server on a laptop served at a public HTTPS address, the gate intact, the Host header rewritten, and a response written in three chunks 300 ms apart arriving in three chunks 300 ms apart. Nothing buffered it, through our own server or through Cloudflare's edge.

Proven

Install, run, uninstall and reinstall. The payload and the installer are both signed and timestamped, and the whole lifecycle completes. Before signing, antivirus removed the binary within ten seconds of setup writing it.

Proven

Traffic counting, in production. Counted to the byte on the live relay, without attaching a single handler to the stream.

Partly

SmartScreen still warns. Signing is what stops the binary being quarantined. Reputation is a separate thing that accrues over downloads, and an organisation certificate does not skip that queue. Expect a warning on the first run until enough people have installed it.

Partly

The Wi-Fi rung on Android. The port, the firewall and the QR code all work. The .local name does not, and cannot: Chrome on Android skips system name resolution. That is why each project gets its own port.

Not yet

Updating itself. There is no auto-update. A new version means downloading it again, and this page is where it will be.

Not yet

macOS and Linux. The scanner is genuinely Windows-specific. Everything above it is not.


Reporting abuse

Something on a beamit.link address

Beamit hands out addresses under beamit.link to whoever installs it, and they point at somebody's own machine rather than at anything we host. If one of them is serving phishing, malware or anything else it should not be, tell us and we will take the address away.

hello@beamit.sh

Include the full address you saw and roughly when. A screenshot helps. We answer abuse reports within two working days.

An address can be withdrawn without the person who holds it being involved, because the name is ours and only the dev server behind it is theirs.