S3 Viewer
Open Viewer

How to download a file from S3

TL;DR

Three patterns. Click it in S3 Viewer (a 15-minute presigned URL is signed server-side; your AWS keys never reach the browser, and the filename and extension are inferred from ContentType). Run `aws s3 cp s3://bucket/key ./` from a terminal. Or send a presigned URL to anyone who doesn't have AWS access.

Steps

Step-by-step.

  1. 01

    In S3 Viewer: click the file

    Hit the download button. The file streams from your bucket through your browser via a short-lived (15 minute) presigned URL signed server-side using your encrypted credentials — your AWS keys never reach the client. The filename and extension are inferred from the object's ContentType header, so the file lands on disk with the right name even if the key was a raw UUID.
  2. 02

    Multi-select to grab several at once

    Shift-click a range and download — same UX as a desktop file manager.
  3. 03

    AWS CLI: aws s3 cp (single file)

    For one file. Streams directly to disk.
    aws s3 cp s3://my-bucket/path/to/file.pdf ./
  4. 04

    AWS CLI: aws s3 sync (whole prefix)

    Mirrors a prefix to a local directory and skips files you already have. The right pattern for backups or local development.
    aws s3 sync s3://my-bucket/reports/ ./reports/
  5. 05

    AWS SDK: GetObject

    For a backend, stream the response body to a file or to a response stream.
    const obj = await s3.getObject({
  Bucket: 'my-bucket',
  Key: 'file.pdf',
});
await pipeline(obj.Body, fs.createWriteStream('./file.pdf'));
  6. 06

    Sharing: presigned URL for someone without AWS

    Right-click → Share link in S3 Viewer, or run aws s3 presign. Same primitive — works in any browser, expires when you say. Treat it as a bearer token.
    aws s3 presign s3://my-bucket/file.pdf --expires-in 3600
Under the hood

What's actually happening.

A download is a GetObject API call. The CLI streams the response body to a local file; SDKs return a readable stream you pipe wherever you want; S3 Viewer signs a short-lived presigned URL server-side using your encrypted credentials, infers the filename and extension from the ContentType header, and the browser fetches that URL — so your AWS keys never reach the client. Sharing with a non-AWS user is the same primitive: a presigned URL is just a signed query-string version of GetObject anyone with the link can fetch until it expires.

FAQ

Common questions.

How do I download a file from an S3 bucket?

Easiest: open S3 Viewer in a browser, click the file, hit download — it streams via a server-side presigned URL with the correct filename and extension inferred from the ContentType header. From a terminal: `aws s3 cp s3://bucket/key ./`. From an SDK: call GetObject and pipe the response body to a file. To share with someone who doesn't have AWS access: generate a presigned URL with `aws s3 presign` or right-click → Share link in S3 Viewer.

How do I download an entire S3 prefix or folder?

From the AWS CLI: `aws s3 sync s3://bucket/prefix ./local-dir` — it mirrors the prefix and skips files already on disk. Programmatically: list the prefix with ListObjectsV2 and GetObject each key in parallel.

How do I download a file from someone else's S3 bucket?

If they sent you a presigned URL, paste it in any browser — it works without an AWS account until it expires. If they invited you to S3 Viewer, sign in and download from the file browser. If they granted your AWS account cross-account access, use your own AWS CLI as normal.

Why do my AWS keys never reach the client in S3 Viewer?

S3 Viewer signs every request server-side using your encrypted credentials, then issues a short-lived presigned URL the browser fetches. Your access key and secret stay encrypted on the server (RSA-4096 at rest); only a 15-minute signed URL ever reaches the client. Even if someone intercepts the URL, it expires fast and only grants that one operation.

Can I download from Cloudflare R2 the same way?

Yes. R2 implements the S3 GetObject API and presigned URLs. The AWS CLI works against R2 with `--endpoint-url`; S3 Viewer's download flow is identical for R2 and AWS S3.
Use S3 Viewer for this

Skip the CLI. Try it in the browser.

S3 Viewer turns the steps above into a single click. Open source, self-hostable, free for personal use.

Open ViewerStar on GitHub