junkerderprovinz/featherdrop repository overview

featherdrop is a feather-light, self-hosted drop zone for your files. Think WeTransfer or Smash, but it runs on your own server with no size paywall. Drop your files (one or a whole batch), set how long they live (plus an optional password or download limit), and share a short link or QR code. Zero-knowledge end-to-end encryption, resumable uploads, inline previews, one tiny container. No accounts, no clouds, no tracking, no nonsense.

A one-knight job: I build it, keep it running, work through the issues and add what people ask for, until nothing is missing. It is free, with no accounts, no telemetry, no ads and no paid tier. No asterisk anywhere. Nothing readable ever leaves your own walls. Forged on evenings and weekends, with heart and stubbornness.

If it has earned a place on your server or computer, toss a coin to your knight: it helps cover the costs and keeps the project alive. It also makes this knight's heart beat a little faster. Three ways below, whichever suits you.

⁠Table of Contents

1. What it looks like⁠
2. What it does⁠
3. Getting started⁠
4. How AI is used here⁠
5. Support this project⁠

⁠1. What it looks like

The files and links in these pictures are made up.

Pick the files, then decide how long they live and how often they can be downloaded

The link is ready: copy it or save the QR code

What the recipient sees, decrypted in their browser

⁠2. What it does

• Zero-knowledge. Files are encrypted in your browser before they upload (libsodium XChaCha20-Poly1305), names included. The key lives in the link's #fragment or comes from the share's password, so the server and anyone with its disk only ever see ciphertext.
• Shares that clean up after themselves. Expiry from one hour to 30 days or never, an optional download limit and an optional password. Several files travel as one bundle under one link and come back out as the originals.
• Big files are fine. Uploads go in resumable 64 MiB chunks, so a dropped connection picks up where it stopped and a size-capped CDN such as Cloudflare does not get in the way.
• Photos travel light. JPEGs lose their EXIF and GPS data in the browser before encryption, unless you switch it off.
• Pleasant to use. Paste a screenshot with Ctrl+V, install it as an app and share to it from Android, preview images, video, audio, text and PDF before downloading, and read it all in 26 languages.
• Safe to put online. Per-IP rate limits, a storage quota, an expiry cap and an optional upload password. Share pages tell search engines to stay away.
• One small container. A static Go binary on a distroless base with a single SQLite file, for amd64 and arm64, with SBOM and provenance attestations and a CVE scan on every build.

It has no user accounts, no OIDC or LDAP, no email and no S3 storage. If you need those, Pingvin Share⁠ is the bigger tool that inspired this one.

⁠3. Getting started

On Unraid, install featherdrop from Community Applications⁠. Anywhere else:

docker run -d --name featherdrop -p 3000:3000 \
  -e BASE_URL=https://share.yourdomain.tld \
  -e CONFIG_DIR=/config \
  -v /path/to/data:/data \
  -v /path/to/config:/config \
  junkerderprovinz/featherdrop:latest

Then open port 3000 and drop a file. /data holds the uploads and /config the small database, so the two can sit on different disks; leave out CONFIG_DIR and the /config mount to keep both in /data.

Put HTTPS in front of it before you share links outside your network. The browser needs a secure context for large uploads, streaming downloads and the clipboard, and over plain HTTP uploads stop at 500 MB. Set BASE_URL to the public address so the links point there, and in Nginx or Nginx Proxy Manager let big uploads through:

client_max_body_size 0;
proxy_read_timeout 3600s;
proxy_send_timeout 3600s;
proxy_request_buffering off;

On an instance anyone can reach, UPLOAD_PASSWORD keeps strangers from uploading while every share link still works for its recipient. Behind a reverse proxy, set TRUST_PROXY=true so the rate limits count real visitors instead of the proxy.

⁠4. How AI is used here

One knight builds this, and AI is one of the tools I work with, the same way I work with an editor or a compiler. It helps me write code and documentation and it checks my work, and that saves me a good many evenings. It does not make the decisions, though. I read and understand everything before it ships, and if something here breaks, that is on me and not on the tool.

You do not have to take my word for it. The code is open and every release note is written by hand. The issue tracker shows how problems actually get handled, including the ones I got wrong the first time. If you find something that is not right, open an issue and I will look at it.

⁠5. Support this project

Questions? Check the support thread⁠. Bugs, ideas or feature requests? Please open a GitHub issue⁠.

A one-knight job: I build it, keep it running, work through the issues and add what people ask for, until nothing is missing. It is free, with no accounts, no telemetry, no ads and no paid tier. No asterisk anywhere. Nothing readable ever leaves your own walls. Forged on evenings and weekends, with heart and stubbornness.

If it has earned a place on your server or computer, toss a coin to your knight: it helps cover the costs and keeps the project alive. It also makes this knight's heart beat a little faster. Three ways below, whichever suits you.

_{The name featherdrop, its logo and its branding are not covered by the AGPL-3.0 licence of the code: a fork needs its own name and look.}