S3 Viewer
Open app

How to download a file from S3

TL;DR

Three patterns. In S3 Viewer, open the ⋮ menu on the row and choose Download (a 15-minute presigned URL is signed server-side, so your AWS keys never reach the browser, and the file saves under the last segment of its object key). Run aws s3 cp s3://bucket/key ./ from a terminal. Or send someone a presigned URL — Copy link in the same menu — when they don't have AWS access.

Steps

Step-by-step.

  1. 01

    In S3 Viewer: ⋮ → Download

    Open the ⋮ menu on the object's row and choose Download. The browser fetches the file straight from your bucket via a 15-minute presigned URL signed server-side with your encrypted credentials — the bytes never pass through our servers and your access key never reaches the client. The file saves under the last segment of its object key, so reports/2026/q4.pdf lands on disk as q4.pdf.
  2. 02

    AWS CLI: aws s3 cp (single file)

    For one file. Streams directly to disk.
    aws s3 cp s3://my-bucket/path/to/file.pdf ./
  3. 03

    AWS CLI: aws s3 sync (whole prefix)

    Mirrors a prefix to a local directory and skips files you already have. The right pattern for backups or local development.
    aws s3 sync s3://my-bucket/reports/ ./reports/
  4. 04

    AWS SDK: GetObject

    For a backend, stream the response body to a file or to a response stream.
    const obj = await s3.getObject({
  Bucket: 'my-bucket',
  Key: 'file.pdf',
});
await pipeline(obj.Body, fs.createWriteStream('./file.pdf'));
  5. 05

    Sharing: presigned URL for someone without AWS

    Use Copy link in the row's ⋮ menu, or run aws s3 presign. Same primitive — works in any browser, expires when you say (15 minutes from S3 Viewer). Treat it as a bearer token.
    aws s3 presign s3://my-bucket/file.pdf --expires-in 3600

Under the hood

What's actually happening.

A download is a GetObject API call. The CLI streams the response body to a local file; SDKs return a readable stream you pipe wherever you want; S3 Viewer signs a 15-minute presigned URL server-side using your encrypted credentials, names the download after the last segment of the object key, and the browser fetches that URL directly from your bucket — so your AWS keys never reach the client and the bytes never pass through our servers. Sharing with a non-AWS user is the same primitive: a presigned URL is just a signed query-string version of GetObject that anyone with the link can fetch until it expires.

FAQ

Common questions.

How do I download a file from an S3 bucket?

Easiest: open S3 Viewer in a browser, open the ⋮ menu on the file's row and choose Download — it fetches via a server-signed presigned URL and saves the file under the last segment of its object key. From a terminal: aws s3 cp s3://bucket/key ./. From an SDK: call GetObject and pipe the response body to a file. To share with someone who doesn't have AWS access: use Copy link in the same ⋮ menu, or aws s3 presign.

How do I download an entire S3 prefix or folder?

From the AWS CLI: aws s3 sync s3://bucket/prefix ./local-dir — it mirrors the prefix and skips files already on disk. Programmatically: list the prefix with ListObjectsV2 and GetObject each key in parallel.

How do I download a file from someone else's S3 bucket?

If they sent you a presigned URL, paste it in any browser — it works without an AWS account until it expires. If they invited you to S3 Viewer, sign in and download from the file browser. If they granted your AWS account cross-account access, use your own AWS CLI as normal.

Why do my AWS keys never reach the client in S3 Viewer?

S3 Viewer signs every request server-side, then hands the browser a short-lived presigned URL to fetch. Your access key and secret are encrypted in your browser before they ever reach us and are only decrypted to run the operation you asked for; only a 15-minute signed URL reaches the client. Even if someone intercepts that URL, it expires fast and grants only that one operation.

Can I download from Cloudflare R2 the same way?

Yes. R2 implements the S3 GetObject API and presigned URLs. The AWS CLI works against R2 with --endpoint-url; S3 Viewer's download flow is identical for R2 and AWS S3.

Use S3 Viewer for this

Skip the CLI. Try it in the browser.

S3 Viewer turns the steps above into a single click. Open source, self-hostable, free.

Open appStar on GitHub