File Browser
File Browser provides a web interface for uploading, deleting, previewing and editing files under a configured server directory; the project has stopped future releases and security fixes.
What File Browser does
File Browser exposes a browser interface for browsing, uploading, downloading, deleting, previewing and editing files under a configured root directory. It stores users and settings in a local single-file database, and its root path determines the data a user can reach. A dedicated low-privilege account and a narrowly scoped directory are essential.
Maintenance and exposure boundary
The project has announced that it will not receive future releases, bug fixes or security fixes. Its command-execution feature can amount to host shell access, and its JWT sessions do not behave like revocable server-side sessions. It should not be introduced as a new public-facing service or used for sensitive files.
If an old instance must remain
Keep the process on a loopback address, place it behind a TLS reverse proxy with separate authentication, block direct access to the upstream port and run it as a non-privileged account or restricted container. Keep command execution disabled, mount only the target directory and plan migration to a maintained service with session revocation and audit support.
Maintenance note
This page was reviewed on 2026-08-23 against File Browser 2.63.23, its stopped-maintenance notice, command-execution and JWT-session boundaries, first-start behavior and Windows amd64 package.
Save to your cloud drive
Open the cloud drive to get the file directly, or save it for convenient access on another device.
Quark Cloud Drive
RecommendedSave File Browser to this cloud drive
Baidu Netdisk
Save File Browser to this cloud drive
File Browser controlled local or internal-network operation guide
Treat this package as a migration assessment or short-lived controlled instance. It is not a recommendation for a new public service or sensitive data store.
Before you start
- Prepare a migration or replacement plan and prefer a maintained service for new deployments.
- Create a dedicated low-privilege Windows account with access only to the target directory.
- Use an isolated test directory, keep command execution disabled and bind the service to a loopback address.
Installation steps
- 01
Extract into a restricted directory
Unzip the program and configuration into a stable location, keeping the shared test directory separate from system folders, keys, backups and application configuration.
- 02
Bind only to the local address
Set the root directory to the test path and retain the default local listener and disabled command execution. Do not open a firewall rule or public port for the upstream service.
- 03
Save the one-time initial password
Read the first-start console output, store the random admin password securely and change it immediately. Confirm the database path before restarting or initializing again.
Quick start
- 01
Verify the visible directory
With a test account, check root, upload, download, edit and delete permissions and confirm that links or symlinks cannot escape the intended directory.
- 02
Add an outer security layer
For controlled remote access, use a TLS-terminating reverse proxy with independent authentication and ensure the backend port cannot be reached around the proxy.
- 03
Plan the shutdown migration
Record users, permissions, root paths and sharing rules, migrate files to a maintained service and then revoke ports, accounts, tokens and the old database.
Usage tips
- Keep command execution disabled; enabling it gives users a path toward host shell capabilities.
- JWT sessions are not equivalent to revocable server sessions, so changing a password or clicking logout may not invalidate every existing token immediately.
- Keep anonymous access and self-registration off, and review any historical configuration that enabled broad default-user permissions.
Troubleshooting and uninstall
What should I do if an old session seems valid after a password change?
Do not rely only on logout or password rotation. Block the service at the proxy or firewall, rotate outer authentication, inspect logs and migrate to a service with session revocation.
Why cannot a low-privilege process read the directory?
Adjust ownership and the minimum required directory permissions only. Do not solve a path issue by running as administrator or mounting the entire system drive.
- Stop service and revoke external accessRemove reverse-proxy routes, firewall ports and scheduled tasks, stop the process, verify migration and then delete the program, database, configuration and obsolete credentials.
Frequently asked questions
Is File Browser suitable for direct public exposure?
No. The project has stopped future releases and security fixes. If an old instance must remain briefly, put it behind TLS, separate authentication, source restrictions and a private upstream listener.
Where is the initial login password?
The first start creates an admin account and prints a random password once in the console log. Save it securely and change it immediately.
Why must the root directory be narrow?
Upload, edit and delete operations are bounded by the configured root. A system-wide or oversized root magnifies the impact of account compromise and operator mistakes.
Does the download require an extraction code?
The Quark entry does not require one; the four-character code for the Baidu entry is shown beside its download entry.