Help – Drop, simply explained

Drop is your own service for big files: download it for free, copy it to your server, done. This page shows how to install it and how to use it – and the demo lets you try it right away, without anything being uploaded.

Install

Download Drop Source code on GitLab

The simple version: four steps

All you need is ordinary web space with PHP – the kind almost every host offers – and an FTP program such as FileZilla or Cyberduck.

1. Download. Click “Download Drop”. You get a ZIP file.
2. Unzip. Double-click the ZIP file. A folder with all the files appears.
3. Upload by FTP. Copy the contents of that folder into your domain's web directory – for example the folder drop.your-domain.com points to.
4. Go through the installer. Open the address in your browser. The installer takes you through five short steps: language, your admin account (name, e-mail, password), address and data folder, e-mail sender – done. Afterwards you sign in with e-mail and password; “Forgot password?” works as for any account.

If the installer reports missing write permissions, set the folders lib and uploads to 755 (or 775) in your FTP program. So that expired transfers get deleted, add a cron job in your host's control panel afterwards – the lines are below, in step 5.

What the installer looks like

Requirements

• PHP 8.1 or newer (64-bit) with sodium, fileinfo and mbstring – part of every standard PHP build. Plus curl for single sign-on, S3, WebDAV and updates, openssl for passkeys.
• Apache with mod_rewrite (the shipped .htaccess is enough) or nginx with PHP-FPM – there is a template in docs/nginx.conf.example.
• HTTPS – without it the browser cannot encrypt end-to-end.
• No database, no Composer, no Node.

The full version: six steps

1. Download and unzip, then copy the folder to the web server – or git clone https://gitlab.com/jensche/s42transfer.git.
2. Give the web server write access to lib/ and uploads/.
3. Open the address in a browser: the installer asks for the language, admin account (name, e-mail, password), address, data folder and sender e-mail.
4. Put the data folder outside the web root if you can. If it stays inside, the .htaccess locks it; on nginx copy the deny all lines from the template.
5. Clean-up by cron – otherwise nothing expires and no reminder goes out:

   12 3 * * * www-data php /path/to/drop/admin.php clean_expired
   16 3 * * * www-data php /path/to/drop/admin.php clean_async

6. Set up a backup before there is anything to lose:

   30 3 * * * www-data /path/to/drop/tools/backup.sh /srv/backups --quiet

Everything else – accounts, single sign-on, S3, colours, logo, SMTP, limits, retention – you set afterwards in the admin at /admin.php.

With Docker

docker pull registry.gitlab.com/jensche/s42transfer:latest
docker compose up -d

Then open http://localhost:8080/ and enter /var/www/data/ as the data folder in the installer. The image runs on amd64 and arm64, cleans up by itself (no cron needed) and keeps the settings on the data volume.

Updates

In the admin under Settings → Update: Drop checks for new versions and installs them with one click. Data, settings and uploads/ stay untouched. Without write access to the code: git pull, upload the new archive, or php admin.php update. Docker: pull the new image.

Demo: send once

The demo runs entirely in your browser. The files you pick never leave your computer – Drop only shows what would happen.

Sending

Adding files

Drag files or a whole folder onto the upload card, or pick them with the button. Folders keep their structure. Big files are uploaded in chunks, four at a time; if the connection drops, pick the same files again and it continues where it stopped.

Link or e-mail

Link: after the upload you copy a short link, with a QR code for a phone if you like. E-mail: you enter recipients and write a message; Drop sends the mail. You confirm your sender address once with a six-digit code – so nobody can send mail in your name.

From a share link

If the file already sits in Dropbox, Google Drive, OneDrive or Nextcloud, paste the share link. The server fetches the file directly, it does not travel twice through your laptop. The admin switches this on.

Send directly

With “Send directly” on the upload card, a file goes from your browser straight to the recipient’s browser. Nothing is uploaded or stored on the server. You pick files, get a link and a QR code, and pass it on. Keep the page open: if you close it, the transfer stops. The recipient first sees names and sizes and says yes. Several files and recipients work, a password is possible; the server checks it before a connection is even offered. The data is always encrypted in transit.

For admins: two browsers need a STUN server to find each other on the internet. It learns their addresses, nothing of the files. The default is Google’s public one. Under Admin → Interface → Send directly you enter your own STUN and TURN servers; a TURN server relays where strict networks allow no direct way. An empty list keeps transfers within one network, and the whole function can be switched off – “Send directly” and “Text instead of a file” each on its own.

Text instead of a file

On the upload card you write a text instead of choosing a file. It is sent as a text file and shown in the browser. With “Delete after the first download” it is gone once read. For admins: the administrator can switch this feature off.

Replace a file

Under My transfers you swap a file without the link changing. The log and downloads stay. The old content is kept, up to five versions; one click goes back.

For admins: a folder on the server becomes a transfer – meant for exports, scanners and backups. You set it up in the admin, or call it by cron: php admin.php inbox --remove prints the link.

Options

Expiry

How long the link works. After that the files are deleted, not just hidden.

Release on

The date and time from which the link works – send it today, open it Monday morning.

Password

Whoever downloads has to enter it. Share it another way than the link.

Download limit

After that many downloads it stops. “Delete after the first download” is the strictest form.

End-to-end encryption

The files are encrypted in your browser. The key is only in the part of the link after the #, which browsers never send to the server. Whoever has the link can download – the server cannot.

See who downloads

Recipients confirm their e-mail address with a code. You see every address with the time – even if the link was forwarded.

Only for certain recipients

Enter addresses or whole @domains; everybody else is turned away after confirming.

Comments

Recipients write below the files. In a video or audio file a comment carries the moment it is about.

View only

Recipients see images, PDFs, video, audio and text in the browser but get no download button. A determined person can still save what the screen shows.

Chosen link name

Instead of a random link you pick a name, such as /q3-deck. Signed-in senders only; the admin switches it on. The name can be guessed – set a password.

Notification

A mail as soon as something was downloaded, and a reminder to recipients a day before expiry.

Recipients

Recipients need neither an app nor an account. They see your message and the files with their sizes, and can view pictures, videos, audio, PDFs and texts before downloading. They download one file at a time or everything as one ZIP. Afterwards My transfers shows you every visit and every download with the time and the device.

If you need to shut somebody out later, bar their personal link – the transfer stays available to everybody else.

Requesting files

A file request is an upload-only link. You send it to clients or suppliers; they upload their files and only see a “thank you”. You get a mail for every upload. For each request you decide which size and which file types are allowed, and you can pause it at any time without deleting what already came in. All requests are listed under My file requests.

A request can also ask questions: Name*, order number … (* = required). The answers come with the files – on the download page, by e-mail and as a notification.

My files

With an account you have a lasting place of your own, with folders. You put a transfer together from it without uploading again, and let colleagues into a folder.

Delivery receipt

Every transfer can be printed as a receipt: what was handed over, every file with its SHA-256 checksum, the message and who downloaded what and when. Give transfers the same job number and they appear on one sheet and come down as one archive.

Account & security

• Sign in with a password, a passkey or – if set up – your company account (single sign-on).
• Two-factor with an authenticator app; switch it on under Account.
• Team: share transfers, address book and files with up to five people.
• Your own brand: name, colour and logo on the download pages of your transfers.
• API tokens for scripts and automation, under Account. curl -T answers with the link on line 1 and the delete link on line 2.
• Push notifications: switch them on per device under Account.

Push notifications

Under Account you switch on push notifications for the device you are using and choose per event: someone downloaded a transfer, uploaded into a file request, commented, and more. The notification appears like any other on phone or desktop and is end-to-end encrypted up to the device (Web Push). On an iPhone the site must first be added to the Home Screen (Share → Add to Home Screen), otherwise Safari offers no notifications. You switch each device on and off separately.

Sign-in (for admins)

• Single sign-on only: password, passkeys and sign-up disappear, and people sign in only through OIDC. Scripts use API tokens. The admin password stays as the way back in if single sign-on ever fails.
• Approval of sign-ups: whoever signs up waits until an administrator lets them in.
• LDAP / Active Directory: sign in with the directory account, using PHP’s own ldap extension – no library. The first sign-in creates the account; an admin group is optional.

Blocked file types (for admins)

In the admin you block file types for the whole server, such as exe, msi, bat or sh. The server enforces the block on every way in: the upload card, scripts and the API, curl -T, link import and the server folder. For a direct transfer, Drop checks the file names. Optionally the server also checks what a file really is, so a program renamed to .pdf is caught (Windows programs, Linux and Mac binaries, shell and batch scripts, disk images, Android apps, PHP). Limit: end-to-end encrypted files are only checked in the browser, because the server never sees them.

Forgotten admin password (for admins)

With shell access, run php admin.php password on the server and set a new password. Without a shell, put a file reset-admin.txt into the data directory by FTP, holding a code of your choice (at least 8 characters). Reload the admin sign-in within the hour: it then asks for that code and a new password. The file is deleted afterwards; a wrong code does nothing.

Administration and type size (for admins)

• Type size: under Design you set the type size in percent, separately for the pages visitors see and for the workbench (account, lists, administration): everything, only the running text or only the headings. The room above the logo is set in pixels.
• Folding: every section of the administration opens and closes.
• Speed: with many transfers the administration is about twice as fast and three times lighter.
• Switches: “Text instead of a file” and “Send directly” can each be switched off.

Frequently asked

Does Drop cost anything?

No. No paid tier, no subscription, no ads. Every feature is open to everyone.

The upload broke off – do I have to start again?

No. Pick the same files again; Drop recognises what has already arrived and uploads only the rest.

My recipient says the link does not work.

Check in My transfers whether the transfer has expired, reached its download limit or has not been released yet. With end-to-end encryption the link has to arrive complete – with everything after the #.

I forgot the admin password.

See “Forgotten admin password” under Account & security: php admin.php password or a file reset-admin.txt in the data directory.

Can I delete a transfer early?

Yes, in My transfers. It stays in the trash for a while in case it was a mistake.

How big can a file get?

Uploads go in chunks; the PHP limits only decide the size of a chunk, not the size of a file. Set a limit per file in the admin if you want one.