S3Exp

S3Exp

s3://

⌘L

Serve this page over HTTPS or from localhost. Browsers withhold crypto.subtle on insecure origins, so encrypted files are unavailable.

Connections

0

Credentials

Session only

No bucket connected

Add a connection with your access key, or load connections from an encrypted file you saved earlier.

Nothing under this prefix

Drop files anywhere on this window to upload them here.

No match in this prefix

The filter only looks at objects already loaded here. Clear it, or navigate to another prefix.

Could not list this bucket

Not connected

First 1,000 objects only

Drop to upload into this prefix

↑↓ move ↵ run esc close

Add connection

Name optional

Access key ID

Secret access key

Bucket

Region

Endpoint optional

Set this for MinIO, Cloudflare R2, Wasabi or DigitalOcean Spaces. Requests switch to path style automatically.

New folder

Name

S3 has no folders. This writes an empty object ending in / so the prefix shows up in listings.

—

Delete

Share link

—

Signed with the active connection's key. It stops working when that key is rotated.

Link expires in

Presigned URL

Uploading

Save encrypted to file

—

AES-256-GCM. Keys, secrets, buckets, names and endpoints all sit inside the ciphertext.

Passphrase for this file

Repeat passphrase

Nothing here can recover this passphrase. Lose it and the file is scrap.

Load credentials from a file

—

—

Passphrase this file was saved with

You already have connections loaded

Help and setup

Keyboard

⌘KCommand palette — jump to a prefix, switch bucket, run anything ⌘LEdit the address bar ↑ ↓Move through objects ↵Open a prefix, or download a file ⌫Up one prefix spaceSelect the object under the cursor ⌘ASelect everything in view /Focus the filter RRefresh delDelete the selection

The address bar

S3 stores keys, not folders — a folder is just a shared key prefix. The bar at the top is the real thing: click it or press ⌘L and type any bucket/prefix/ to jump straight there. Naming a different bucket switches to the matching connection.

CORS rules

A browser cannot read a bucket that does not allow it. In the AWS console under S3 → your bucket → Permissions → CORS, paste:

[{
  "AllowedHeaders": ["*"],
  "AllowedMethods": ["GET","PUT","POST","DELETE","HEAD"],
  "AllowedOrigins": ["*"],
  "ExposeHeaders": ["ETag"]
}]

Narrow AllowedOrigins to the exact origin serving this page once it works.

Permissions to grant

s3:ListBucket, s3:GetObject, s3:PutObject, s3:DeleteObject — scoped to the one bucket.

Where credentials live

Nothing is kept in this browser. Credentials sit in sessionStorage for this tab and disappear when you close it, so a stolen or synced browser profile holds no keys.

Save encrypted to file, load from file

Save encrypted to file writes your connections to a .s3vault file: AES-256-GCM, key derived from a passphrase you choose with PBKDF2-HMAC-SHA256 at 310,000 iterations, random 16-byte salt, fresh IV per save. The file is unreadable without the passphrase, so it is safe to back up or carry between machines. Load from file decrypts in memory and either adds to your list or replaces it. A wrong passphrase or an edited file fails to decrypt rather than loading anything.

What encryption does not cover

While you are connected the plaintext keys are in page memory, so anything running in this page can read them — XSS, a browser extension, or a tampered CDN script (the AWS SDK loads from sdk.amazonaws.com). A leaked file cannot be revoked either: changing the passphrase does not help, because the old copy still opens with the old one. If a file goes missing, rotate the S3 keys themselves. Scope credentials to one bucket, grant the four actions above and nothing more, and keep the file where you would keep a password database.