ShareX is a comprehensive screenshot, image editing, and file sharing application for Windows. It features a modular architecture with separate libraries for screen capture, image editing, uploading, helpers, history, and tools. The application supports capturing screenshots/recordings, applying annotations and effects, uploading to over 50 services, and includes various productivity tools. Built with .NET/C# using a mix of Windows Forms and Avalonia UI frameworks, it employs MVVM patterns, plugin architectures for extensibility, and cross-cutting helper libraries. The system handles data flows from capture through editing to upload/storage, with history tracking for user convenience.
File Browser is a self-hosted web-based file manager written in Go with a Vue 3 frontend. It provides a complete file management interface (upload, download, preview, edit, share, search) within a specified directory, accessible via a web UI or CLI. The architecture is a monolithic single binary that embeds the frontend assets and serves both the API and static files. Key entry points: main.go (CLI), cmd/root.go (Cobra commands), http/http.go (HTTP router), frontend/src/main.ts (Vue app). Data flows: HTTP requests → middleware (auth, rules) → handlers (resources, shares, search, preview, upload) → storage layer (BoltDB via storm) → filesystem (afero with ScopedFs for symlink confinement). External dependencies: BoltDB (embedded KV store), gorilla/mux (routing), gorilla/websocket (shell), tus-js-client (resumable uploads), ace-builds (editor), video.js (media), vue-i18n (30+ languages). The project is in maintenance-only mode per README but shows active commits (last 2026-06-30), regular releases, and security fixes.
ProjectSend is a self-hosted secure file sharing platform built as a modular Laravel application with an Inertia.js + React frontend. The codebase is organized into domain modules — Files, Clients, Groups, Identity, Comments, Notifications, Audit, Platform, and Api — each containing controllers, services, policies, models, and event hooks. Staff members upload and share files with clients or groups, manage roles and permissions, enforce download limits, expire or version files, and monitor activity through a detailed audit log. Clients access their own portal with four switchable themes (default, compact, drive, gallery), and public share links support additional presentation themes with pagination, previews, and controlled downloads. The application is a monolith with strong modular boundaries rather than microservices. Authentication supports local accounts, LDAP, social login/SSO via OIDC, two-factor authentication, CAPTCHA, and password policies. A REST API protected by Sanctum tokens offers scoped abilities, RFC 7807 problem details, polling-based pagination, and an OpenAPI contract that is drift-tested against the live route surface. Background jobs handle zip downloads, email digests, thumbnails, file cleanup, and scheduled maintenance. The system persists settings, activity logs, notification preferences, and upload metadata in a relational database, while file payloads can be stored on local disks, S3-compatible storage, or Google Cloud Storage. The code is notably security-conscious: secrets are encrypted at rest, old input flashing excludes credentials, CSRF cookie naming is customized to avoid collisions, download paths are never exposed in API responses, and regression tests cover disclosure boundaries, permission scoping, token revocation, and account erasure. The test suite is extensive, using Pest feature tests to exercise permissions, file lifecycle edge cases, version chains, comment visibility, API contracts, and authentication flows. The architecture favors event-based extension points and registry patterns, making modules independently testable and partially reusable, though the project remains an application rather than a framework or library. Overall this is a well-crafted, actively maintained application with clean engineering practices, clear separation of concerns, and unusually thorough security regression coverage. Its main complexity is the large surface area of interchangeable themes, editions, authentication backends, and storage drivers, which creates some ongoing drift risk, but current CI, recent commits, and dependency management show the project is keeping pace with its ecosystem.
DashBeam is a peer-to-peer encrypted file transfer application that operates without a central server. Built on the Iroh networking stack (QUIC, BLAKE3, relays), it enables direct device-to-device transfers with end-to-end encryption, NAT traversal via relays, and local LAN discovery via mDNS. The application is cross-platform, targeting desktop (Windows, macOS, Linux via Tauri), Android, and web (via a Rust WASM bridge). Its architecture cleanly separates a core protocol crate (P2P wire format, pairing, identity) from platform-specific I/O crates (native disk I/O for desktop/mobile, in-memory for web), all wrapped by a unified engine facade. The frontend is a modern React/TypeScript SPA with Zustand state management, a comprehensive UI component library built on Base UI, and 20+ locale translations. The system supports one-time share tickets, permanent device pairing, broadcast mode, transfer progress with resume, and self-hosted infrastructure. No telemetry or accounts are required, and the AGPL-3.0 license ensures openness.
zrok is a production-grade, self-hostable secure resource sharing platform built on OpenZiti overlay networking. It enables users to share web services, files, TCP/UDP tunnels, and VPN connections through firewalls and NAT without requiring inbound connectivity. The system supports both public and private sharing modes, OAuth authentication (GitHub, Google, OIDC), and includes a full REST API (v2), a CLI tool (`zrok2`), a React web console, a background agent daemon with gRPC remote control, and SDKs in Go, Python, and Node.js. Architecturally, zrok follows a controller-agent pattern. The controller is a Go REST server that manages accounts, environments, shares, accesses, frontends, namespaces, organizations, and bandwidth limits. It uses SQLite3 or PostgreSQL for persistence with versioned migrations, and integrates with InfluxDB for usage metrics and RabbitMQ (AMQP) for dynamic proxy mapping updates. The agent runs as a background process on the user's machine, managing child processes for each share/access and exposing a gRPC API for remote management. Frontend proxies (public, dynamic, socks, Caddy) handle incoming traffic with OAuth, basic auth, and interstitial pages. Key entry points include the CLI commands under `cmd/zrok2/` (e.g., `share`, `access`, `enable`, `admin`), the controller REST handlers in `controller/`, the agent gRPC service in `agent/agentGrpc/`, and the SDK packages in `sdk/golang/sdk`, `sdk/python/src/zrok2`, and `sdk/nodejs/sdk`. The system also includes a canary testing framework for continuous health validation and a comprehensive metrics/limits engine for bandwidth enforcement. External dependencies include OpenZiti (overlay network), InfluxDB (metrics), RabbitMQ (messaging), Caddy (optional web server), and various OAuth providers. The project is actively maintained with frequent commits, automated CI/CD, and multi-platform release pipelines (Linux, macOS, Windows, Docker).
LocalSend is a free, open-source, cross-platform application for secure local file sharing over a local network without internet access. It supports Android, iOS, macOS, Windows, Linux, and a CLI, using a combination of Flutter for the UI and Rust for performance-critical networking, cryptography, and file transfer logic. The architecture is modular: a core Rust library (`packages/core`) implements the LocalSend protocol (v2/v3) with HTTP/HTTPS, multicast discovery, WebRTC, and TLS encryption; a Flutter app provides the graphical interface with state management via Refena (Redux-like) and i18n support for 50+ languages; and a separate CLI and WebRTC signaling server are also included. The app features device discovery, file/message transfer with progress tracking, PIN protection, checksum verification, quick-save, receive history, and a web share mode that allows browser-based downloads/uploads. The codebase demonstrates high craftsmanship with clean separation of concerns, extensive integration tests, and reusable patterns such as typed isolate communication, custom DNS resolution for IPv6 scoped addresses, and connection rate limiting.
AList is a self-hosted file listing and sharing gateway written in Go. In production it aggregates over 100 distinct storage backends — local disk, Aliyun Drive, OneDrive, Google Drive, S3, Baidu, PikPak, Thunder, WebDAV mounts, FTP/SFTP servers, and more — behind a unified virtual file tree, then exposes that tree simultaneously through a web UI + REST API, WebDAV, an S3-compatible object storage endpoint, FTP, SFTP, and an MCP (Model Context Protocol) tool server. It is a monolithic Go application (Gin + GORM) deployed as a single binary or Docker container, with a rich feature surface: role/permission-based multi-user access with path-scoped grants, password-protected time-limited shares with burn-after-read and download tracking, pluggable search backends (Meilisearch, Bleve, database full-text, no-index), offline downloads via aria2/qBittorrent/Transmission plus cloud-native tools, archive extraction (zip/7z/rar/iso9660), device session limits, rate limiting, SSO/LDAP/WebAuthn auth, and an FRP reverse-proxy client for NAT traversal.
QRServ is an Android application that turns a device into a local file-sharing server. Users select files (or use Direct Access Mode for single files without copying), and the app starts an embedded Ktor HTTP server on an unused port. The server URL is displayed as a QR code for other devices on the same network to scan and download files. Optionally, on Android 13+, QRServ can create a private Wi-Fi hotspot (with band selection on Android 16+) so that only devices joining the hotspot can access the files. The app runs a foreground service with a persistent notification, handles HTTP range requests for large files, and includes an idle timeout that automatically stops the server when no downloads occur for a configurable period. The architecture follows a standard Android MVVM pattern with Jetpack Compose UI, using StateFlow for reactive state management and a centralized ViewModel (QRServViewModel) that orchestrates server lifecycle, network callbacks, and hotspot control. The codebase demonstrates strong engineering practices including comprehensive unit tests, separation of concerns into repositories and controllers, and careful handling of Android-specific edge cases such as permission revocations, network changes, and file removal during sharing. The app is available on Google Play and IzzyOnDroid with multi-language support.
Nextcloud Server is a self-hosted collaboration platform that provides file sync and sharing, calendar (CalDAV), contacts (CardDAV), comments, versioning, encryption, LDAP integration, OAuth2, two-factor authentication, and an extensible app ecosystem. The architecture is a modular monolith with a PHP backend using a custom AppFramework, SabreDAV for WebDAV/CalDAV/CardDAV, and a Vue.js frontend (mixing Vue 2 and Vue 3). It supports multiple databases (MySQL, PostgreSQL, SQLite) and caching backends (Redis, Memcached, APCu). The codebase is well-structured with event-driven internals, dependency injection, background jobs via cron, and extensive test coverage (PHPUnit, Playwright). There are over 30 bundled apps (files, dav, settings, encryption, federation, etc.) that follow plugin architecture. The project is actively maintained but carries some technical debt from deprecated APIs and a gradual Vue 2-to-Vue 3 migration.
copyparty is a portable, multi-protocol file server written in Python. It serves files over HTTP/WebDAV, FTP, SFTP, TFTP, and SMB/CIFS, with a rich web UI for browsing, uploading (resumable, chunked, deduplicated), searching, and media playback. The server supports user authentication, per-volume permissions, event hooks, metadata extraction, thumbnail generation, and audio transcoding. It can run on minimal dependencies (Python 3.3+), and is packaged as a self-extracting script, Docker image, or native installer. The architecture is modular: a central service hub (SvcHub) orchestrates protocol servers, a virtual filesystem (VFS) enforces permissions, and a broker pattern handles parallel tasks. The codebase includes a large set of example hooks, handlers, and plugins for customization. While the project is actively maintained and well-documented, it carries some technical debt from supporting very old Python versions and vendored libraries.
Cloudreve is a production-grade, self-hosted file management system (v4) built with Go, Gin, and the ent ORM. It provides a full-featured cloud storage platform supporting multiple storage backends (local, S3, Aliyun OSS, Tencent COS, Huawei OBS, Qiniu, Upyun, OneDrive), WebDAV, WOPI for online Office editing, OAuth2, WebAuthn passkeys, full-text search via Meilisearch, thumbnail generation (vips, ffmpeg, LibreOffice), media metadata extraction (EXIF, ffprobe), and a background task queue for async operations like archive creation, remote downloads, and indexing. The architecture follows a layered pattern with dependency injection, a database-backed filesystem (DBFS) with navigators, an event hub for real-time file events, and a master-slave cluster for distributed nodes. The codebase is well-organized into reusable packages (e.g., pkg/request, pkg/queue, pkg/cache, pkg/auth) and includes a comprehensive admin panel for managing users, groups, storage policies, tasks, and nodes. While primarily an application, it also incorporates data engineering patterns like media metadata extraction and full-text indexing for user-facing features.
The Network Media Library plugin for WordPress Multisite provides a central media library shared across all sites in the network. It achieves this by designating one site as the central media library and temporarily switching the context to that site during media operations (upload, insertion, editing, etc.). The plugin hooks into numerous WordPress actions and filters to intercept media-related requests and redirect them to the central site. It also includes compatibility layers for popular third-party plugins like Advanced Custom Fields and MultilingualPress to ensure they work correctly with the shared media library. The code is organized into a single main file with several classes encapsulating specific functionalities, such as managing context switches, preserving post thumbnail IDs during save operations, and handling ACF field rendering.
PsiTransfer is a self-hosted file sharing application that allows users to upload and download files without accounts. It uses the tus resumable upload protocol for reliable large file transfers, supports password protection, one-time downloads, and archive downloads (zip/tar.gz). The backend is built with Node.js and Express, with a Vue.js frontend. The architecture is a monolith with a clear separation of concerns: an Express server handles routing, a file store manages disk I/O with path traversal protection, an in-memory database tracks metadata with garbage collection, and a custom tus protocol implementation (tusboy) handles resumable uploads. The codebase demonstrates good security practices (argon2 password hashing, input validation, safe filename handling) and is actively maintained with CI/CD, Docker support, and comprehensive tests.
atmoz/sftp is a Docker image that provides a production-ready SFTP server built on OpenSSH. At runtime, the container starts sshd with a chroot jail, forcing every user into their own home directory and restricting access to SFTP only. User accounts are provisioned from three sources: command-line arguments, the SFTP_USERS environment variable, and a mounted users.conf file. The entrypoint merges these definitions on first run, generates unique SSH host keys if none are mounted, and optionally executes custom scripts from /etc/sftp.d before launching sshd or passing through arbitrary commands. The core logic lives in two well-crafted Bash scripts. files/create-sftp-user parses compact user specifications (user:pass[:e][:uid[:gid[:dir1,dir2]]]), validates them with POSIX regexes, creates system users with optional UID/GID, sets plain or encrypted passwords, aggregates SSH public keys from .ssh/keys into a deduplicated authorized_keys file, and creates writable subdirectories. files/entrypoint handles configuration merging, first-run initialization, host key generation, and command passthrough. The sshd_config enforces secure defaults: no root login, no TCP forwarding, no X11, and internal-sftp with ChrootDirectory %h. The project includes a solid integration test suite (tests/run) using shunit2 that works with both Docker and Podman, exercising real SFTP sessions, key-based login, directory creation, custom UID/GID, and legacy config paths. CI workflows rebuild images daily to pick up OpenSSH security updates and run ShellCheck plus signature verification. The codebase is small, focused, and well-maintained, with no significant technical debt or security debt. It is a strong example of a purpose-built infrastructure container with clean shell scripting and meaningful test coverage.
A client-side single-page web application providing an interactive comparison tool for premium debrid services (AllDebrid, Real-Debrid, TorBox, Premiumize, etc.). It displays pricing, file host support (over 300 hosts), adult host support, usenet availability, and links to tools and community resources. The app is built with vanilla JavaScript (ES modules), Vite, and Workbox for offline support. Data is bundled as static JSON files directly imported at build time. The UI features searchable/filterable tables with lazy rendering, a side-by-side comparison module, dark mode, and responsive design. The codebase is well-structured, modular, and demonstrates good engineering practices including accessibility (ARIA labels, skip link, focus management), performance optimizations (content-visibility, skeleton loaders, debounced search), and a component lifecycle pattern for resource cleanup. It does not have tests or CI/CD pipelines.
FileCodeBox is a file and text sharing service built with FastAPI and Tortoise ORM. It allows users to upload files or text accessible via short codes, with features including time/count-based expiration, chunked uploads, pre-signed URLs for direct cloud storage uploads, and an admin dashboard for management. The architecture uses a modular design with separate apps for base functionality and admin, storage abstraction for multiple backends (local, S3, OneDrive, WebDAV, OpenDAL), and background tasks for cleanup. Key entry points include main.py (FastAPI setup), apps/base/views.py (public sharing endpoints), and apps/admin/views.py (admin interfaces). The service demonstrates solid engineering practices with reusable components like storage abstraction and security headers, though some areas like settings management and rate limiting show opportunities for improvement in distributed environments.
Packet is a GTK4/libadwaita desktop application for Linux that implements the Google Quick Share protocol, enabling wireless file transfer between Linux and Android devices. The application discovers nearby devices via Bluetooth and mDNS over Wi-Fi, and supports sending files, text, links, and Wi-Fi passwords. It integrates deeply with the GNOME desktop: a Nautilus plugin adds a "Send with Packet" context menu, a D-Bus API allows external control, and it can run in the background with a system tray icon. The codebase is written in Rust, using the `rqs_lib` library for the Quick Share protocol logic. The architecture follows a standard GtkApplication pattern with custom GLib object types for transfer state, asynchronous file operations using tokio, and a modular widget system for transfer cards. The code is well-structured overall, though the main window file is large and some FIXMEs indicate areas for improvement. The project has active maintenance, comprehensive localization (30+ languages), and a CI pipeline.
This repository contains a single PHP file (index.php) that implements a minimalistic file hosting service. It allows users to upload files via HTTP POST (e.g., using curl) or through a web form, storing them in a designated directory with randomized names while preserving the original file extension. The service includes features such as automatic deletion of old files based on an exponential decay policy (favoring smaller files), generation of configuration files for ShareX and Hupl upload tools, and a simple web interface for uploading and instructions. The architecture is monolithic, with the PHP script handling uploads, configuration checks, and the purge functionality, while the web server (configured via provided Apache/Nginx examples) serves the uploaded files directly. Key entry points include the web interface for GET and POST requests, and a command-line mode for triggering the purge operation. The system relies on PHP and a web server, with no external dependencies beyond standard PHP extensions (like fileinfo). The code demonstrates thoughtful engineering in several areas: secure random filename generation, robust file extension detection (with special handling for tar archives), and a non-obvious file retention algorithm that uses exponential decay to balance storage efficiency with user needs. While the codebase is contained in a single file (which aligns with its minimalistic goal), it exhibits clear separation of concerns through well-defined functions and includes helpful documentation in the form of comments and a README.
RetroShare is a decentralized, peer-to-peer communication and file-sharing application built with C++ and Qt. It provides encrypted messaging, chat lobbies, forums, channels, file transfer, photo sharing, microblogging (The Wire), and a plugin system (VOIP, FeedReader). The architecture is a monolith with a core library (libretroshare) providing services like GXS (Generic eXchange System) for distributed group data, a Qt-based GUI (retroshare-gui), a headless service (retroshare-service), and a standalone friend server for Tor-based peer introduction. The codebase is large and mature, with extensive unit tests and a simulation framework for peer-to-peer testing. While many components are well-crafted, there is unfinished code, disabled tests, and some technical debt from long-term evolution.
ownCloud Core is the server-side component of ownCloud Classic, a file synchronization and sharing platform. In production, it provides file storage, synchronization, sharing (internal and federated), WebDAV/CalDAV/CardDAV access, versioning, trash bin, system tags, comments, external storage backends (SMB, SFTP, WebDAV, Google Drive, etc.), encryption, user/group management, and a plugin architecture for extending functionality. The system handles file upload/download via WebDAV or OCS API, manages sharing permissions and propagation, runs background jobs for maintenance (expiration, cleanup, sync), and supports federation between ownCloud instances. The architecture is a monolithic PHP application with a plugin system (apps) that register capabilities, routes, settings panels, and background jobs. Key entry points include index.php (main request handler), occ CLI (Symfony Console commands for admin tasks), cron.php (background job execution), and apps/dav/appinfo/v2/remote.php (WebDAV server). The codebase uses a custom PHP framework with namespaced public interfaces (OCP) and internal implementations (OC), SabreDAV for WebDAV/CalDAV/CardDAV, Symfony Console for CLI, Doctrine DBAL for database migrations, and Guzzle HTTP client for federation. Primary data flows involve file operations (upload, download, move, copy) through the filesystem abstraction layer, with metadata stored in a relational database (MySQL, MariaDB, PostgreSQL, SQLite). Sharing creates permission records and propagates changes via event hooks. Federation uses OCM protocol for cross-server sharing. Background jobs handle trash expiration, version cleanup, external storage scanning, and federation sync. External dependencies include a database server, optional memcached for caching, and external storage services (SMB, SFTP, WebDAV servers, Google Drive). The codebase is large (7844 files) with extensive localization (20+ languages) and testing (PHPUnit, Behat acceptance tests, JS specs). It shows signs of ongoing maintenance with recent commits and CI activity, but also contains legacy code, deprecated interfaces, and a custom PHP dialect (traits via use keyword) that may hinder standard tooling.