F-Drop
A self-hostable secure file transfer web app
Need to send a file to another device? 1) Log in to your account, 2) upload your file, 3) copy & send its download link, or log in on another device to download the file
Protect any download link by whitelisting email addresses of recipients to require them to log in to access the file. Or for convenience, let guest users use the link.
For additional security, password-encrypt the file on uploading, or have the download link expire after one-time use or at a specific date/time.
- letsencrypt certifcate installation (or opt-out)
- server-side file encryption on uploading
- password salting, hashing and strength checks
- safeguards against common attacks, e.g. cross‑site request forgery (CSRF)
- a per-file password-derived encryption key
- an expiry time for the download link (DL link)
- how many times the DL link may be used
- a file recipient whitelist (by email addresses)—including of recipients yet to register
- has no user tracking or analytics software
- works with Javascript disabled in browsers
- handles self-signed (or other) TLS certificates
- does not send requests to third-party servers for static resources (images, fonts, javascript, css)
- a user's disk quota (and the default: 20 MB)
- a user's max file size (and the default: 20 MB)
- the max. aggregate disk quota across all users
- the max. period accounts can remain inactive before being deleted (default is 4 months)
The goal with F-Drop is to enable anyone with Linux server skills to deploy a user-friendly file-transfer web app for themselves and possibly for their family or friends in order to provide them with greater control over their data.
Out of the box, the program comes with plenty of configuration options such as to remove this home page, to enable self-registrations, or to include & configure a Privacy Policy and/or Terms of Service for users to accept upon registration.