filexSelf-hosted file manager

One Go binary. Connect it to local disks, S3, SFTP, WebDAV, FTP or SMB - and reach it back as S3, SFTP, FTPS, NFS, WebDAV or a mounted drive.

Get Started

Live Demo

What's new

GitHub

✍️

Apps - things to do with a file

A second kind of plugin - a sandboxed WebAssembly module, an interface of its own that filex runs in a sandboxed frame, or both - adding actions to the file menu, screens and public pages for people with no account. Installed from a GitHub address or a trusted store's link through a review of every permission it asks for, with exactly that grant, and the people of your filex can browse a store's catalog on filex's own App store screen and ask for an app; the review also says plainly what a browser cannot promise about an interface. An interface prints through filex, on the person's Allow, and an end-to-end encrypted file is offered to no app. Apps say when their source has a newer version, nothing is installed until an administrator has reviewed what it changes, and the previous version is one click away. Four ship alongside filex as public repositories - e-Signature, which sends a document round for signature and seals the finished file with the installation's own seal, Convert, filextext (an end-to-end encrypted text workspace) and draw.io. Write your own in stock Go, against a test kit.

Apps docs

🌍

Your language, right to left included

English and Turkish are built in; any other language is a language pack - a manifest of strings, no code and no release - which joins every picker and translates the explorer, the admin panel, the public pages and the text the server writes, with its coverage of this version shown beside it. Plural forms follow CLDR. Arabic, Hebrew, Persian and Urdu lay the whole interface out right to left, and stop where mirroring would be wrong. A person has one language - the account's - in the web app, the desktop app and every notification, and the ONLYOFFICE editor opens in it too.

Right-to-left docs

🎨

Wear your own colours

Compose named themes on the admin Appearance screen - twelve colours for light and for dark, a corner radius, a font stack, previewed as you type - and make one the instance default. It reaches the sign-in page and every public link too, because branding that stops at the login is not branding.

Themes & appearance

🌐

A browser client for your users

Give someone a user or viewer account and the address …/drive, and they land on their own Home - their storages, what they opened last, what they starred - one click from the file manager itself, with its uploads, sharing, search and editor, and with no admin panel around it and no separate frontend to deploy. …/admin is the operator's door to the same application, and it opens on the same Home. On a phone the same web app installs like an app, from a band that offers it on the first visit.

Roles and access

🖥️

Desktop app

The same explorer in its own window on Windows, Linux and macOS - several accounts at once, right-click a folder or file to keep it on the computer, sync that keeps running when the window is closed, and double-click an Office document on your own disk to edit it without Office installed. Not allowed to install software? Every platform also has a copy that runs from wherever you put it, and the Windows portable one keeps all its files in one folder beside the .exe. Get it from the Microsoft Store, the Snap Store or Homebrew.

Desktop docs

🪄

Drag files out, copy between storages

Drag a selection onto your desktop and it lands as separate real files and folders, not an archive. Copy or cut in one storage and paste in another - filex streams the tree between the two backends, keeps every timestamp, and only removes the original once the copy is verified.

How dragging out works

🔁

Folder sync

A folder on your PC kept in step with a folder on the server, both ways, live - an edit on either side arrives in about a second instead of on the next 30-second lap - from the desktop menu or the CLI, with a bandwidth limit and a sync window when you want them. The first sync deletes nothing, holds back a big re-upload and asks first, and a delete never beats an edit.

Sync docs

🔍

Search that forgives

Find files by name or by what is inside them, across every mounted storage. "invoice 2026" finds invoice_2026.pdf, "mian.go" finds main.go, and tag:source narrows to what you tagged - with exact matches always ranked first.

Search docs

🔌

Speaks your tools' protocols

Point rclone, restic, aws s3, WinSCP, FileZilla, a scanner that only learned FTP or a media player that only learned NFS straight at filex - S3, SFTP, FTPS, NFS and WebDAV, all on the same tree with the same permissions and trash as the web UI.

Protocol docs

🧩

Teach it a new storage

A backend filex has never heard of is a separate program you install from the admin panel or from an app store's link - it describes its own config form, and its driver then behaves like any built-in one. Any language; a Go SDK makes it three methods. Every capability it claims is probed before anyone can build a storage on it, and a store lists only a plugin its own validator checked, with every build pinned and signed.

Plugin docs

📊

What your storage costs

filex does not meter your provider's bill - it reads the report the provider already writes and prices it with a table you can edit. Backblaze B2's daily report is read over the same S3 API filex already speaks, and the free allowances are shown beside the billable lines, because "your downloads were free this month" is usually the thing worth knowing.

Usage & cost docs

🖼️

Thumbnails you can read

A PDF shows its first page, top-anchored so the title is in the card; a video its first frame that is not black, because a fade-in used to produce a black square; an Office document its rendered first page; a text file its own first lines and an archive what is in it; an SVG is drawn by a built-in engine on every install, and HEIC and AVIF photos through ImageMagick. A folder shows the three files that came into it last. A thumbnail follows its file when it changes, an installed app can draw the kinds filex does not, and a file whose tool is missing is named, not papered over - Admin → Tools → Thumbnail repair says what to install and redraws a file, a folder or a storage.

Thumbnail docs

💾

Mount it as a drive

filex mount attaches a remote server over ordinary HTTPS - a folder on Linux, a drive letter on Windows. Not a sync - it opens one file out of a hundred thousand without downloading the rest.

How to mount

🌐

WebDAV

Mount your drives in Finder, Explorer or davfs2 - every storage served over one WebDAV endpoint.

WebDAV docs

⌨️

CLI

The same binary doubles as a remote client - script uploads, downloads and syncs, copy and move across storages, the trash, versions, tags, archives and an app's actions, each server job followed to its end. filex encrypt turns a folder - one on disk, or one on the server where it is - into an end-to-end encrypted folder, the keys made on your own machine, for folders too large for a browser tab.

CLI docs

🧭

Navigation people already know

A left panel led by one "+ New" menu - upload files, a new folder, a new document, a file request; the destinations Home, My files, Shared with me, Recent, Starred, Drafts (a new document waits there, visible to nobody else, until you save it where it belongs) and Trash; your tags, each one opening the files carrying it; and the storages you can reach - a storage somebody granted you simply appears there, one click, no mount instructions. It is also where "How to connect" and your own API keys live, so an embedded copy of the explorer can hand a user the credential WebDAV or FTPS asks for - unless the embed is proxied with one shared app token, in which case the surfaces that belong to a single person are left out. Collapse it to an icon rail from the top bar when you want the width back. Everything around it is one shell, drawn by every embed with no string passed - one search field in the header with its palette shortcut, a Type/Owner/Modified/Size filter row, Folders and Files as sections, and Details/Activity in the info panel - and uiProfile 'simple' reduces it for people who want a file drive rather than a file manager.

Turning it on

🧩

Embeddable UI

Drop the explorer into any app as a Vue 3 or React component, or a framework-free web component.

Integration docs

🤖

MCP for AI agents

A token-authenticated automation surface that speaks Model Context Protocol - let agents browse, read, write and copy files, run an app's action such as Convert, work the trash, versions, archives and their own links, and hand them credential-free upload tickets for files too big to pass through a model. Every tool runs the explorer's own handler, so the rules are the explorer's, and an admin key reaches what the panel does. The REST half is described in an OpenAPI 3.1 file.

MCP docs

🛡️

Roles and permissions

Everyone has one role - Administrator, User, Viewer or a custom role that is its own list of 29 permissions, with limits and folder exceptions - given to the person or through a group they are in, plus per-person exceptions, per-file and per-folder grants with inheritance, and the permissions installed apps declare. Enforced in the backend on every door, from the web app and the agent API to WebDAV, SFTP, FTPS, S3 and NFS; an API key is held to its own verbs on each of them.

Roles & permissions docs

🗂️

An admin panel you can find your way in

Every administrator page sits in one menu of three panels - Files & storage, People & security, System - two clicks away, and one search beside it (Ctrl+K, a button on a phone) finds a page, a single setting, a person, a group, an API key, an app, a storage or a share by its name in your language or in English, and only what you may open.

Admin panel docs

👥

Groups

Named sets of people, per tenant. Share a folder with a group as you would with a person, and give a group a role that everyone in it without a role of their own holds - a role priority decides between groups. People are added by hand, or follow the groups their sign-in carries - an OIDC claim, LDAP memberOf, the operating system's groups or a proxy header - joining and leaving at every sign-in as the identity provider says.

Groups docs

🪪

Sign in with a Windows or Linux account

People sign in with the login they already have on the machine filex runs on - a Windows account, local or of the domain, or a Linux account through PAM. The operating system judges the password and filex never stores it; system and service accounts never get in, and the provider is switched on only after a real account has signed in with it in a test.

Operating-system accounts

🚦

Sign-in attempt limits

Wrong passwords are counted per account and per address, on the web form and on WebDAV, FTPS and SFTP alike. Five for an account or ten from an address within ten minutes shut the door for a minute, doubling up to fifteen; the form says how many tries are left. An IP allow-list is the way back in, the Sign-in security page lists the locks and the trail, and a forwarded client address is believed only from the proxies you trust.

How the limit works

🔐

End-to-end encrypted folders

Encrypted in the browser with WebCrypto: the server stores ciphertext and never receives a key. A folder encrypts its contents, or its contents and its names; a folder you already have, or a single file, is encrypted where it is. Each gets a recovery key, shown once, so a forgotten password is not automatically lost data - and an operator can optionally hold an escrow key, with the limits stated rather than implied. Who may encrypt is the organisation's call: nobody, administrators, everyone whose role allows it, or anyone after an administrator's approval. A third level, the vault, hides the shape of the tree as well - built, and off until the server turns it on.

How it works

🏙️

Tenants that run themselves

One instance, many tenants, each isolated, each with its own sign-in name (its realm). A tenant's administrator adds the tenant's own OIDC or LDAP, the operator binds shared sign-in providers to one tenant or several, every tenant gets a platform subdomain, and a tenant's own domain is proven by a CNAME and served with a certificate from your proxy, from filex itself through ACME, or its own. Multi-tenant mode itself is one switch in the admin panel - off, no screen shows a tenant, and turning it off deletes none.

Tenant self-service

🏢

LDAP / Active Directory

Directory accounts sign in on the same password form as local ones - and with the same password on WebDAV, SFTP and FTPS. Directory sync opens accounts for everyone in the directory, keeps groups and memberships in step and disables whoever the directory disables; people are known by their permanent directory id, and a directory group can make its members administrators. Private CA supported; local login stays first, so your break-glass account works while the directory is down. An entry with no e-mail gets an address of the form name@local, and an account an older filex opened under the bare name is adopted, not doubled.

LDAP docs

⚡

Live updates and presence

An open explorer is told what changed over a WebSocket instead of polling for it, and shows who else is in the folder and what they are looking at. One write appears the moment it lands; a burst - a zip extraction, a folder upload, an NFS client writing chunk after chunk - is merged into one frame per window, so five thousand files arriving at once cost the page a bounded trickle rather than five thousand redraws.

Realtime docs

🔔

Webhooks

Any number of webhook targets, each with its own signing secret and its own list of events, plus a persistent in-app bell - all filled from the same single call. An optional digest tells a busy folder in one notification - thirty files added is one badge step, not thirty - while every webhook still hears each event at once. A file that arrived and a file somebody replaced are different events, and an infected upload, a failed one or an encrypted folder opened with its recovery key can each be subscribed to on their own. The server says every notification, in each reader's own language, and Web Push brings them to a phone or a browser with filex closed.

Notifications docs

🦠

Antivirus

Optional ClamAV scanning on every write, including the built-in editor and files the storage sync discovers - through a local binary or a clamd container over the network - with quarantine, retention windows and infected-file events.

Protection docs