sThree Browser Open the app

Your buckets. Your keys. No one in between.

sThree Browser is a safe, open-source S3 browser. Your credentials stay encrypted on your device, and every request goes straight from you to your storage.

Open the app Host your own

Works with AWS S3, Cloudflare R2, MinIO and any S3-compatible storage.

The shortest path
is the safest one.

Most tools pass your keys through someone's server. sThree doesn't have one. The host only hands your browser some static files; after that it's just you and your bucket.

Your device Keys encrypted here
A middleman server Not on the route
Your bucket S3, R2, MinIO and more

An encrypted vault

Connections and credentials are one AES-256-GCM ciphertext, keyed from your master password with scrypt. On desktop it's also bound to the OS keychain.

Signed on your device

Every S3 request is signed locally and sent straight to the storage endpoint. The site's host never sees a key, a file or a request.

Zero tracking

No analytics, no telemetry. This page doesn't load a single file from anywhere else either.

Everything you do in a bucket.
None of the console.

Browse like a file manager

Breadcrumbs, sorting by name, size and date, folder sizes worked out in the background, and full keyboard navigation.

Upload any size

Large files go up in parallel parts. Cancel one, and it cleans up after itself.

Look before you download

Images, video, audio and code, previewed right beside the list.

Delete on purpose

Folder deletes show how many objects go and ask you to type the name.

Locks itself

After 15 idle minutes, or when you press Lock, every decrypted secret is cleared.

Many buckets, in order

Connections to every provider in colour-coded groups. Or set one to ask for keys each session and never save them.

Any S3.
Any screen.

AWS S3Cloudflare R2MinIOWasabiAny S3-compatible API

  • WebAny modern browser, with a CORS rule on each bucket
  • macOSDesktop app, vault bound to the Keychain
  • WindowsDesktop app, bound to Credential Manager
  • LinuxDesktop app, bound to Secret Service

Light, dark, or follow the system. Desktop installers are built from source for now.

Host it yourself
in one line.

The web version is a folder of static files in a 13 MB image. No application server, a non-root user, and nothing that ever touches your data.

  • Strict Content-Security-Policy and no-referrer headers
  • GET /health for your orchestrator
  • Or any static host: nginx, Caddy, Cloudflare Pages, Netlify
Terminal
docker run -d -p 8888:8888 --name sthree-browser ghcr.io/mohamadtahir/sthree-browser:latest

Open http://localhost:8888, then serve it over HTTPS.

Bucket CORS rule for the web version

Your browser talks to S3 directly, so each bucket must allow your site's origin. The app shows this exact rule when one is missing.

[{
  "AllowedOrigins": ["https://sthree.example.com"],
  "AllowedMethods": ["GET", "PUT", "POST", "DELETE", "HEAD"],
  "AllowedHeaders": ["*"],
  "ExposeHeaders": ["ETag", "Content-Length", "Content-Type", "Last-Modified"],
  "MaxAgeSeconds": 3600
}]

Open your buckets.

Create a master password, add a key and a bucket, and you're in. No account, no sign-up.

Open the app Source on GitHub