Browse like a file manager
Breadcrumbs, sorting by name, size and date, folder sizes worked out in the background, and full keyboard navigation.
Your buckets. Your keys. No one in between.
sThree Browser is a security-focused, open-source browser for S3 buckets. Your credentials stay encrypted on your device, and every request goes straight from you to your storage.
Works with AWS S3, Cloudflare R2, MinIO and any S3-compatible storage.
The shortest path
is the safest one.
Some web-based S3 tools route your keys through their own server. sThree doesn't have one. The host only hands your browser some static files; after that it's just you and your bucket.
Your device
Keys encrypted here
A middleman server
Not on the route
Your bucket
S3, R2, MinIO and more
An encrypted vault
Connections and credentials are one AES-256-GCM ciphertext, keyed from your master password with scrypt. On desktop it's also bound to a key in the OS keychain, when one is available.
Signed on your device
Every S3 request is signed locally and sent straight to the storage endpoint. The site's host only serves the app's files; it never receives your keys, your files or your S3 requests. Rather not trust our copy? Host your own: it's the same code.
Zero tracking
No analytics, no telemetry, no cookies, in the app or on this page, which loads nothing from anywhere else. The hosted copies are served through Cloudflare, which keeps standard request logs.
Everything you do in a bucket.
None of the console.
Upload any size
Large files go up in parallel parts. Cancel one, and it cleans up after itself.
Links that expire
Share a file, not your keys. Anyone with the link can open it until it expires on schedule.
Look before you download
Images, video, audio and code, previewed right beside the list.
Delete on purpose
Folder deletes show how many objects go and ask you to type the name.
Locks itself
After 15 idle minutes, or when you press Lock, the app drops its decrypted settings and reloads.
Many buckets, in order
Connections to every provider in colour-coded groups. Or set one to ask for keys each session and never save them.
Any S3.
Any screen.
Amazon S3Cloudflare R2MinIOWasabiOther S3-compatible APIs
- WebAny modern browser, with a CORS rule on each bucket
- macOSDesktop app, vault bound to the Keychain where available
- WindowsDesktop app, bound to Credential Manager where available
- LinuxDesktop app, bound to Secret Service where available
Light, dark, or follow the system. Desktop installers are built from source for now.
Host it yourself
in one line.
The web version is a folder of static files in an image of about 13 MB. No application server, a non-root user, and the server never handles your keys or your files.
- A Content-Security-Policy that blocks third-party scripts, frames and plugins, plus no-referrer headers
GET /healthfor your orchestrator- Or any static host: nginx, Caddy, Cloudflare Pages, Netlify (copy the headers from
public/_headers)
docker run -d -p 8888:8888 --name sthree-browser ghcr.io/mohamadtahir/sthree-browser:latestOpen http://localhost:8888, then serve it over HTTPS.
Bucket CORS rule for the web version
Your browser talks to S3 directly, so each bucket must allow your site's origin. The app shows this exact rule when one is missing.
[{
"AllowedOrigins": ["https://sthree.example.com"],
"AllowedMethods": ["GET", "PUT", "POST", "DELETE", "HEAD"],
"AllowedHeaders": ["*"],
"ExposeHeaders": ["ETag", "Content-Length", "Content-Type", "Last-Modified"],
"MaxAgeSeconds": 3600
}]Open your buckets.
Create a master password, add a key and a bucket, and you're in. No account, no sign-up.