ANDROID WEB & FTP SERVER

CYBER//HOST

Turn your Android phone into a full-featured web server.
Host on your local network or share your site with the world.

๐ŸŒ HTTP & HTTPS
๐Ÿ“ FTP, FTPS & WebDAV
๐Ÿ—„ SQLite Data API
๐Ÿ”‘ Token Auth
๐Ÿ”’ 12+ Security Layers
๐Ÿ“Š Live Analytics
v2.9.2  ยท  No ads  ยท  No tracking  ยท  100% Local
HTTPHTTPS ยท WebDAV ยท FTP
RESTSQLite Data + Auth API
12+Security Layers
50+Settings
0Data Collected
CAPABILITIES

Everything you need to
host from your phone

CYBER//HOST packs a full server stack into a single Android app โ€” no root required, no cloud, no subscriptions.

๐ŸŒ

HTTP & HTTPS Web Server

Serve any static website, HTML app, or file collection to devices on your local Wi-Fi network, or share it with the world using port forwarding. Enable HTTPS with a self-signed or custom TLS certificate for encrypted connections.

  • Configurable HTTP port (default 8080)
  • HTTPS with self-signed or custom certificate
  • Redirect HTTP โ†’ HTTPS automatically
  • HTTP Basic Authentication
  • Directory listing toggle
  • Gzip & Brotli compression
  • Precompressed (.br / .gz) sidecar assets
  • Static-asset caching (Cache-Control / ETag)
  • Range requests โ€” stream & seek video/audio
  • SPA fallback routing for single-page apps
  • Custom MIME types & response headers
  • Markdown rendering (.md โ†’ styled HTML)
  • Custom 404 / 403 error pages
  • Live reload (auto-refresh connected browsers)
๐Ÿ“

FTP & FTPS Server

Upload, download, and manage your website files from any FTP client โ€” FileZilla, WinSCP, CyberDuck, and more. Enable FTPS for encrypted transfers.

  • Configurable FTP port (default 2121)
  • Custom FTP username & password
  • FTPS (TLS-encrypted FTP)
  • IP-based access control
  • Passive mode with dedicated port range
  • Sandboxed to website directory โ€” your device files stay safe
๐Ÿ—‚

In-App File Manager

Browse, rename, delete, and preview your hosted files directly inside the app. No FTP client required for quick edits.

  • Full folder tree navigation
  • File size & modification date
  • One-tap delete
  • Breadcrumb navigation
New
๐Ÿ—„

SQLite Data API & Token Auth

Your phone isn't just serving files โ€” it's a backend. Turn on the REST Data API and any SQLite table becomes CRUD endpoints under /data/<table>. Add the Auth API for user registration, login and bearer-token sessions, then require a valid token to read or write your data. Build a real full-stack app with the phone as the server.

  • REST CRUD over SQLite (/data/โ€ฆ)
  • Configurable URL prefix per database
  • User accounts: register / login / logout / me
  • Authorization: Bearer token sessions
  • Optional "require login" to protect data
  • Runs behind every security layer & CORS
New
๐Ÿ–‡

WebDAV Network Drive

Mount your website root as a network drive straight from Windows Explorer, macOS Finder or Linux โ€” drag & drop files with no FTP client at all.

  • Full read/write WebDAV (RFC 4918)
  • Mount in Explorer / Finder / GVFS
  • Authenticated with your FTP credentials
  • Confined to the website root
  • Large files stream straight to disk
New
๐Ÿงฉ

Server-Side HTML Templating

An opt-in template engine renders shared headers, variables and simple logic into your HTML at request time โ€” no build step, no framework.

  • Includes / partials: {{include header.html}}
  • Variables from query & server values
  • Conditionals: {{#if}} โ€ฆ {{else}}
  • Loops: {{#each}} โ€ฆ {{/each}}
  • Auto HTML-escaping (raw opt-in)
New
๐Ÿ”—

Expiring Share Links

Generate a public link to any file with its own expiry, optional password and download cap โ€” perfect for sending someone a single file safely.

  • Time-based expiry
  • Optional password protection
  • Maximum-download limit
  • Revoke any link instantly
New
๐Ÿ›ฐ

Dynamic DNS

Keep a hostname pointed at your phone even when your public IP changes. CYBER//HOST pings your provider's update URL on a timer.

  • Works with DuckDNS, No-IP, Dynu & more
  • Configurable update interval
  • Set-and-forget background updates
New
๐Ÿ˜

Dynamic Scripting Engine

For advanced users, CYBER//HOST includes a complete CGI/FastCGI execution pipeline for PHP, Node.js and Python โ€” every request passes through all the same security layers first.

  • PHP via per-request CGI or persistent FastCGI
  • Node.js & Python CGI runtimes
  • Source is never leaked as plain text

Advanced / optional: these runtimes require a compatible native interpreter binary for your device โ€” they are not bundled. Everything else on this page works out of the box.

๐Ÿ“ก

Network Status

All your server addresses, local and public. One-tap copy and QR codes make it easy for devices on your Wi-Fi to connect, while the public IP display is your key to global access via port forwarding.

  • Local IP, HTTP, HTTPS & FTP addresses
  • Public IP display
  • QR code for LAN address
  • One-tap copy to clipboard
  • mDNS / Zeroconf local discovery
๐Ÿ“Š

Live Traffic Monitor

Watch every HTTP request scroll in real-time with method, path, status code, latency, and the requesting IP โ€” just like a real server console.

  • Request method colour-coding (GET/POST/PUT/DELETE)
  • HTTP status badges
  • Client IP display
  • Response latency in ms
  • Bytes served per request
  • Persistent access log
โšก

Bandwidth & Analytics

Deep insights into your server's performance โ€” live throughput, historical speed chart, per-IP stats, and a traffic heatmap.

  • Real-time speed gauge (KB/s)
  • Peak & average speed
  • Total requests & bytes served
  • Per-IP requests & bytes table
  • Server uptime counter
  • Bandwidth alert notifications
  • Top files report
๐Ÿ”Œ

USB OTG Drive Support

Plug in a USB OTG drive and import a complete website in seconds, or back up your hosted files straight to the drive. No cables to a PC needed.

  • Import website from USB drive
  • Export/back up to USB drive
  • Drive label, file count & used space cards
  • Animated storage capacity bar
  • Format drive option
๐Ÿ•

Server Scheduler

Set automatic start and stop times so your server only runs when you need it โ€” perfect for overnight demos or timed local sites.

  • Daily start & stop time
  • Runs silently in the background
  • Works with the foreground service to survive screen-off
๐Ÿ”—

Network Source Mode

Point CYBER//HOST at any HTTP URL on your local network and serve that content โ€” great for proxying another device's dev server to the rest of your LAN.

  • Fetch & serve from a local URL
  • Toggle on/off without restarting
๐Ÿ“ฑ

Home Screen Widget

A glanceable widget on your home screen shows server status at a glance and lets you start or stop the server without opening the app.

  • Displays server online/offline status
  • One-tap start / stop
  • Updates in real time
QUICK START

Up and running in
under 60 seconds

No configuration files, no SSH โ€” just install, tap start, and your website is live on your local network or ready to be shared online.

01

Install & Launch

Download CYBER//HOST from the Google Play Store and open it. The app starts with your HTTP server ready to go on port 8080 and FTP on port 2121.

TIP Grant the notification permission when prompted โ€” this keeps the server running when your screen is off.
CYBER//HOST
โ–ถ
TAP TO START
02

Upload Your Website via FTP

Open any FTP client (FileZilla, WinSCP, CyberDuck โ€” even your file manager) and connect to the FTP address shown in the Status tab. Upload your HTML, CSS, JS, and image files to the website folder.

$ ftp 192.168.1.42 2121
Username: cyber
Password: host
230 User logged in, proceed.
FTP CLIENT
๐Ÿ“„ index.html
๐ŸŽจ style.css
โšก app.js
๐Ÿ“ท hero.jpg
03

Share the Address or QR Code

The Status tab shows your local address (e.g., http://192.168.1.42:8080). Tap it to copy or scan the built-in QR code with any device on the same Wi-Fi network to open your site instantly.

TIP Any device on your Wi-Fi โ€” phones, laptops, smart TVs โ€” can open your site in their browser.
UNLOCK GLOBAL ACCESS To share with the world, configure port forwarding on your router's firewall. This forwards traffic from the internet to your phone, making your site globally accessible.
Scan to connect
04

Secure & Customise

Head to Settings to enable HTTPS, set a website password, configure the IP blocklist, turn on DDoS protection, enable the Data API, or tweak any of the 50+ options to make the server exactly how you want it.

TIP All settings save automatically โ€” no restart button needed.
โš™ SETTINGS
HTTPS
BASIC AUTH
DDOS SHIELD
GZIP
LIVE RELOAD
PROTECTION

Military-grade security
built right in

CYBER//HOST isn't just a server โ€” it's a hardened server. Every layer of protection is toggleable with a single switch.

๐Ÿ›ก

TLS / HTTPS Encryption

Serve your website over HTTPS using a self-signed certificate generated on-device, or import your own custom certificate. Also supports FTPS for encrypted FTP transfers.

๐Ÿ”

HTTP Basic Authentication

Password-protect your website entirely. Only users with the correct credentials can browse your hosted content. Fully themeable auth dialogs.

โ›”

IP Block & Allow Lists

Block or exempt individual IPs โ€” or whole CIDR ranges (e.g. 192.168.1.0/24). Exempt your LAN in one tap so trusted devices are never throttled or banned.

New
โš–

Escalating Auto-Bans

Repeat offenders get exponentially longer bans and become permanent after a set number of strikes. Optionally POST a JSON alert to a webhook (Discord-compatible) whenever an IP is banned.

New
๐Ÿงฑ

Secure Response Headers

On by default: X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and HSTS over HTTPS โ€” sane, hardened defaults on every response.

๐Ÿšฆ

DDoS Rate Limiting

Sliding-window rate limiter throttles any IP that sends too many requests in a given time window โ€” fully configurable max requests and window duration.

๐Ÿฏ

Honeypot Trap

Automatically bans bots and scanners that probe known attack paths like wp-login.php, .env, phpinfo.php, and dozens more. Add your own custom bait paths.

๐Ÿ—บ

Geo-IP Filtering

Restrict access by network origin. Choose to block all WAN (internet) traffic and allow only local network clients, or vice versa โ€” great for purely internal tools.

๐Ÿค–

User-Agent Blocklist

Automatically block known malicious scanners and bots by User-Agent string โ€” including sqlmap, nikto, nmap, masscan, and more. Add your own custom block rules.

๐Ÿ”‘

Brute-Force Protection

Tracks failed authentication attempts per IP. After a configurable number of failures within a time window the IP is automatically banned from further login attempts.

๐Ÿ”’

Biometric Settings Lock

Lock the Settings panel behind your device's fingerprint or face unlock so no one else can change your server configuration.

๐ŸŒ

CORS Control

Enable and configure Cross-Origin Resource Sharing headers โ€” set specific allowed origins or use a wildcard for open access.

๐Ÿ“

Path Traversal Blocking

All served files are strictly sandboxed to the app's private website directory. Path traversal attempts (../) are detected and rejected โ€” your device files are always safe.

๐Ÿ•ต

Zero Telemetry

No analytics, no ad SDKs, no crash reporters, no tracking of any kind. CYBER//HOST contains zero third-party tracking code. All data stays on your device.

PERSONALISE

Four stunning themes.
Pick your aesthetic.

Every theme is applied globally โ€” dashboard, dialogs, sub-pages, and the server's own web UI all update instantly.

โ—ˆ CYBER Cyan & Magenta on deep space black โ€” the signature look.
DEFAULT
โ—ˆ GREEN Phosphor green terminal. Classic hacker aesthetic.
โ—ˆ SYNTHWAVE Purple & pink neon on a midnight purple background.
โ—ˆ AMBER Warm amber & orange on a near-black background.
CONFIGURATION

50+ settings.
All auto-saved.

Every option saves the moment you change it โ€” no restart button, no fuss.

๐ŸŒ Web Server

HTTP Port8080
HTTPS Port8443
HTTPS EnabledON
Basic AuthOFF
Directory ListingON
Gzip CompressionON
Brotli CompressionON
Static CachingON
Precompressed AssetsOFF
SPA FallbackOFF
HTTPS RedirectON
Security HeadersON
Custom MIME Typesโ€”
Live ReloadOFF
Markdown RenderON
Custom Error PagesOFF

๐Ÿ“ FTP Server

FTP Port2121
FTP Usernamecyber
FTP Passwordโ€ขโ€ขโ€ขโ€ข
FTPS EnabledOFF
WebDAVON

๐Ÿ”’ Security

IP Blocklistโ€”
DDoS ShieldON
HoneypotON
Geo-IP FilterLAN only
UA BlocklistON
Brute-ForceON
LAN Auto-ExemptON
Ban Webhookโ€”
CORSOFF
Biometric LockOFF

๐Ÿ—„ Backend & APIs

Data API (SQLite)ON
Data API Prefix/data
Auth APION
Allow RegistrationON
Require LoginOFF
HTML TemplatingOFF
Dynamic DNSOFF
Share Links2 active

โš™ System

SchedulerOFF
BW AlertON
USB DriveOFF
mDNS DiscoveryOFF
Network SourceOFF
Access LogON
Auto UpdatesON
CHANGELOG

Always improving.
Latest updates.

v2.9.2

Documentation & Consistency

IMPROVED
  • In-app release notes and dashboard now document the full current feature set
  • Privacy policy updated for accuracy (on-device access log; optional Dynamic DNS / webhook requests)
  • Version alignment across the app and website
v2.9.1

Backend-as-a-Service

NEW
  • SQLite Data API โ€” REST CRUD endpoints under a configurable /data prefix
  • Auth API โ€” user register / login / logout / me with bearer-token sessions
  • Optional "require login" gate to protect the Data API
  • APIs run behind every security layer, with CORS support
v2.8.0

WebDAV, Share Links & Dynamic DNS

NEW
  • WebDAV (RFC 4918) โ€” mount the website root as a network drive in Explorer/Finder
  • Expiring share links with optional password and max-download limits
  • Dynamic DNS updater for DuckDNS, No-IP, Dynu and more
v2.7.0

Templating & Dynamic Scripting

NEW
  • Server-side HTML templating โ€” includes, variables, if and each
  • PHP execution engine via per-request CGI or persistent FastCGI
  • Node.js & Python CGI runtimes (require a compatible native binary)
  • Script source is never served as plain text
v2.6.0

Serving & Security Upgrades

NEW SECURITY IMPROVED
  • Brotli compression, precompressed (.br/.gz) sidecar assets and static-asset caching
  • SPA fallback routing, custom MIME types and HTTPโ†’HTTPS redirect
  • Secure response headers on by default (nosniff, X-Frame-Options, Referrer-Policy, HSTS)
  • Escalating & permanent auto-bans, LAN auto-exempt and CIDR-range block/allow lists
  • Ban webhooks โ€” POST a JSON alert (Discord-compatible) when an IP is banned
v2.5.0

Google Play In-App Updates

NEW
  • Google Play In-App Updates API โ€” update banner with one-tap install button
  • Auto-update toggle in Settings โ†’ Updates
v2.4.4

USB Drive UI Redesign

NEW IMPROVED
  • USB stat cards with label, file count, and used space
  • Animated storage capacity bar with shimmer effect
  • Colour-shifting warning at high utilisation (orange >60%, red >85%)
  • 2ร—2 action button grid layout
v2.4.3

USB Detection Overhaul

FIX IMPROVED
  • Four independent USB OTG detection methods including StorageManager API and /proc/mounts parsing
  • Scoped storage fallback for Android 11+
  • Expanded mount path candidates
v2.4.0

Quality of Life

IMPROVED
  • Theme-aware native dialogs (confirm, prompt, alert)
  • All settings auto-save โ€” no restart button
  • Themed sub-pages (Privacy Policy, Release Notes)
  • Public IP copy now includes full URL format
v2.3.0

Google Play Ready

SECURITY FIX
  • FTP credentials hidden from dashboard โ€” directed to Settings panel
  • QR code generation fix โ€” resolves scanning failures
  • Material You monochrome icon for Android 13+
๐Ÿ”

Zero data collection. Full stop.

CYBER//HOST contains no analytics, no ads, no crash reporters, no tracking code of any kind. All data โ€” your website files, settings, and TLS certificates โ€” stays entirely on your device. By default the only outbound requests are an on-device Play Store update check and a single call to api.ipify.org to display your public IP. If you turn on optional features like Dynamic DNS or ban webhooks, the app contacts only the provider URL you configure โ€” nothing else.

Read the full Privacy Policy โ†’

Ready to host from your pocket?

No subscriptions. No servers. Just your phone.

GET IT ON GOOGLE PLAY
Android 8+  ยท  No root required