Share S3 files without sharing AWS.

Two ways to share an S3 file with someone who doesn't use AWS or Cloudflare: a 15-minute presigned link for one-off access, or an email invite for ongoing access. S3 Viewer makes both one click — and the invite is revocable, given a role, and tied to a logged-in user instead of a bearer link.

Email invite — recipients sign in to a clean file viewer in any browser
Roles: Owner, Admin, Editor, Viewer — with per-bucket overrides
Remove any member instantly — no IAM keys to rotate

Open app Star on GitHub

Why teams pick S3 Viewer

A clean browser view for clients, designers, and execs.

Email invites

Send an invite; the recipient signs in with an email and password, or with GitHub, and sees only the buckets you shared. No AWS account, no IAM user, no Cloudflare login, no setup.

Server-side request signing

S3 Viewer checks the member's role and then signs the S3 call with the server's stored credentials. Your access keys never reach their browser; removing the member stops their requests immediately.

Read-only by default

Viewers can browse and download but cannot upload, rename, or delete. Drop-in safe for clients, executives, lawyers, and external reviewers.

Copy link for one-offs

Need a single file with no signup? Copy link in the row's ⋮ menu gives you a presigned URL, signed server-side and valid for 15 minutes. Works in any browser; treat it as a bearer token.

Encrypted credentials

Your AWS keys are encrypted in your browser before they reach us and decrypted in memory only to sign a request. Recipients never see them.

Remove in one click

Pull access without rotating IAM keys. They lose access to that server, your other teammates keep working, your applications keep running.

How it works

Three steps to your bucket.

No agents to install, no infrastructure to manage. Paste credentials and you're browsing.

01
Connect the bucket once
Click Add server and enter your AWS S3 or Cloudflare R2 credentials, region and endpoint. The buckets appear in your sidebar; the credentials are encrypted in your browser before they reach us.
02
Invite by email
Open the server's bucket list, click Share to open the members dialog, type the recipient's email and choose a role: Viewer (browse and download), Editor (also upload, rename, delete and create buckets where supported) or Admin (also manage members, rename the server and remove buckets). They get an emailed invite.
03
They open it in any browser
They sign in with an email and password, or with GitHub, accept the invite, and see exactly the buckets you shared. No AWS account, no IAM user, no Cloudflare account, nothing to install.

FAQ

Common questions.

Direct answers we wish we'd had when picking a viewer.

How do I share an S3 file with someone who doesn't have an AWS account?

Two ways. Quickest: open the ⋮ menu on the file in S3 Viewer and choose Copy link — a presigned URL good for 15 minutes, which works in any browser. Best for ongoing access: invite them by email from the Share dialog. They sign in to S3 Viewer in a browser, see only the buckets you shared, and never touch AWS, IAM, or the CLI.

Is an email invite better than a presigned URL?

It depends on the use case. A presigned URL is the right tool for a one-off share — short-lived, no signup needed, works in any browser. An invite is the right tool for ongoing access: revocable in one click and tied to a specific signed-in user with a role. Presigned URLs are bearer tokens, so they can't be revoked once shared; invites can.

Can I let someone view files but not delete or upload?

Yes. The Viewer role can browse and download but cannot upload, rename, or delete. Editors can upload, rename, delete and create buckets where supported; Admins can also manage members, rename the server and remove buckets from it; the Owner can also delete the server. Object rename and deletion work the same way on every connected provider, not just AWS S3. A bucket can override a member's server role, so the same person can be a Viewer on one bucket and an Editor on another.

Can the recipient see other buckets on my server?

Only the ones the server exposes. When you add a server you can name exactly which buckets it may reach, and members never see anything outside that list.

What happens when I remove someone?

They lose access to that server on their next request and S3 Viewer stops signing calls for them. Unlike rotating an IAM key, nothing else breaks — your other teammates and your applications keep working.

How long can a presigned URL last?

AWS allows presigned URLs up to 7 days when signed with IAM user credentials, or up to the session length when signed with temporary credentials (typically 1 hour for STS). Shorter is safer. Every URL S3 Viewer issues lasts 15 minutes, which keeps the blast radius small.

Can I do this with Cloudflare R2?

Yes. Add an R2 server and invite users to it. They never need a Cloudflare account — S3 Viewer authenticates them. R2 supports the same presigned URL pattern as AWS S3, so one-off shares work identically.

Related guides

Step-by-step how-tos.

All guides

Share an S3 file

Copy link for a 15-minute presigned URL, or an email invite for ongoing access — when each is the right call.

Invite a teammate

Skip per-person IAM users for human collaboration. Email invite, per-bucket role, one-click revoke.

Granular permissions

The IAM s3:prefix Condition that everyone misses, plus when workspace roles are simpler than IAM.

Keep exploring

Other use cases

All use cases

Multi-cloud

AWS S3, Cloudflare R2, MinIO, B2, and Wasabi — same sidebar, same file browser, one server at a time.

Team workspaces

Per-bucket roles, no per-person IAM, and one-click off-boarding without rotating any keys.

Better S3 browser

Browse and preview across providers, with guarded rename and multi-select deletion on AWS S3.