Skip to main content

http file sharing hub

Project description

โ‡†๐ŸŽ‰ copyparty

  • http file sharing hub (py2/py3) (on PyPI)
  • MIT-Licensed, 2019-05-26, ed @


turn your phone or raspi into a portable file server with resumable uploads/downloads using any web browser

  • server only needs py2.7 or py3.3+, all dependencies optional
  • browse/upload with IE4 / netscape4.0 on win3.11 (heh)
  • resumable uploads need firefox 34+ / chrome 41+ / safari 7+ for full speed
  • code standard: black

try the read-only demo server ๐Ÿ‘€ running from a basement in finland

๐Ÿ“ท screenshots: browser // upload // unpost // thumbnails // search // fsearch // zip-DL // md-viewer

get the app

Get it on F-Droid '' f-droid version info '' github version info

(the app is NOT the full copyparty server! just a basic upload client, nothing fancy yet)

readme toc


download and you're all set!

running the sfx without arguments (for example doubleclicking it on Windows) will give everyone read/write access to the current folder; see -h for help if you want accounts and volumes etc

some recommended options:

  • -e2dsa enables general file indexing
  • -e2ts enables audio metadata indexing (needs either FFprobe or Mutagen), see optional dependencies
  • -v /mnt/music:/music:r:rw,foo -a foo:bar shares /mnt/music as /music, readable by anyone, and read-write for user foo, password bar
    • replace :r:rw,foo with :r,foo to only make the folder readable by foo and nobody else
    • see accounts and volumes for the syntax and other permissions (read, write, move, delete, get)
  • --ls '**,*,ln,p,r' to crash on startup if any of the volumes contain a symlink which point outside the volume, as that could give users unintended access

on servers

you may also want these, especially on servers:

on debian

recommended additional steps on debian which enable audio metadata and thumbnails (from images and videos):

  • as root, run the following:
    apt install python3 python3-pip python3-dev ffmpeg

  • then, as the user which will be running copyparty (so hopefully not root), run this:
    python3 -m pip install --user -U Pillow pillow-avif-plugin

(skipped pyheif-pillow-opener because apparently debian is too old to build it)


general notes:

  • paper-printing is affected by dark/light-mode! use lightmode for color, darkmode for grayscale
    • because no browsers currently implement the media-query to do this properly orz


  • iPhone/iPad: use Firefox to download files
  • Android-Chrome: increase "parallel uploads" for higher speed (android bug)
  • Android-Firefox: takes a while to select files (their fix for โ˜๏ธ)
  • Desktop-Firefox: may use gigabytes of RAM if your files are massive seems to be OK now
  • Desktop-Firefox: may stop you from deleting files you've uploaded until you visit about:memory and click Minimize memory usage


feature summary

  • backend stuff
    • โ˜‘ sanic multipart parser
    • โ˜‘ multiprocessing (actual multithreading)
    • โ˜‘ volumes (mountpoints)
    • โ˜‘ accounts
    • โ˜‘ ftp-server
  • upload
    • โ˜‘ basic: plain multipart, ie6 support
    • โ˜‘ up2k: js, resumable, multithreaded
    • โ˜‘ stash: simple PUT filedropper
    • โ˜‘ unpost: undo/delete accidental uploads
    • โ˜‘ symlink/discard existing files (content-matching)
  • download
  • browser
    • โ˜‘ navpane (directory tree sidebar)
    • โ˜‘ file manager (cut/paste, delete, batch-rename)
    • โ˜‘ audio player (with OS media controls and opus transcoding)
    • โ˜‘ image gallery with webm player
    • โ˜‘ textfile browser with syntax hilighting
    • โ˜‘ thumbnails
      • โ˜‘ ...of images using Pillow, pyvips, or FFmpeg
      • โ˜‘ ...of videos using FFmpeg
      • โ˜‘ ...of audio (spectrograms) using FFmpeg
      • โ˜‘ cache eviction (max-age; maybe max-size eventually)
    • โ˜‘ SPA (browse while uploading)
  • server indexing
  • markdown
    • โ˜‘ viewer
    • โ˜‘ editor (sure why not)


small collection of user feedback

good enough, surprisingly correct, certified good software, just works, why


project goals / philosophy

  • inverse linux philosophy -- do all the things, and do an okay job
    • quick drop-in service to get a lot of features in a pinch
    • there are probably better alternatives if you have specific/long-term needs
  • run anywhere, support everything
    • as many web-browsers and python versions as possible
      • every browser should at least be able to browse, download, upload files
      • be a good emergency solution for transferring stuff between ancient boxes
    • minimal dependencies
      • but optional dependencies adding bonus-features are ok
      • everything being plaintext makes it possible to proofread for malicious code
    • no preparations / setup necessary, just run the sfx (which is also plaintext)
  • adaptable, malleable, hackable
    • no build steps; modify the js/python without needing node.js or anything like that

future plans

some improvement ideas

  • the JS is a mess -- a preact rewrite would be nice
    • preferably without build dependencies like webpack/babel/node.js, maybe a python thing to assemble js files into main.js
    • good excuse to look at using virtual lists (browsers start to struggle when folders contain over 5000 files)
  • the UX is a mess -- a proper design would be nice
    • very organic (much like the python/js), everything was an afterthought
    • true for both the layout and the visual flair
    • something like the tron board-room ui (or most other hollywood ones, like ironman) would be :100:
  • some of the python files are way too big
    • ended up doing all the file indexing / db management
    • should be separated into modules in general


  • Windows: python 3.7 and older cannot read tags with FFprobe, so use Mutagen or upgrade
  • Windows: python 2.7 cannot index non-ascii filenames with -e2d
  • Windows: python 2.7 cannot handle filenames with mojibake
  • --th-ff-jpg may fix video thumbnails on some FFmpeg versions (macos, some linux)
  • --th-ff-swr may fix audio thumbnails on some FFmpeg versions

general bugs

  • Windows: if the up2k db is on a samba-share or network disk, you'll get unpredictable behavior if the share is disconnected for a bit
    • use --hist or the hist volflag (-v [...]:c,hist=/tmp/foo) to place the db on a local disk instead
  • all volumes must exist / be available on startup; up2k (mtp especially) gets funky otherwise
  • probably more, pls let me know

not my bugs

  • Chrome issue 1317069 -- if you try to upload a folder which contains symlinks by dragging it into the browser, the symlinked files will not get uploaded

  • iPhones: the volume control doesn't work because apple doesn't want it to

    • future workaround: enable the equalizer, make it all-zero, and set a negative boost to reduce the volume
      • "future" because AudioContext is broken in the current iOS version (15.1), maybe one day...
  • Windows: folders cannot be accessed if the name ends with .

    • python or windows bug
  • Windows: msys2-python 3.8.6 occasionally throws RuntimeError: release unlocked lock when leaving a scoped mutex in up2k

    • this is an msys2 bug, the regular windows edition of python is fine
  • VirtualBox: sqlite throws Disk I/O Error when running in a VM and the up2k database is in a vboxsf

    • use --hist or the hist volflag (-v [...]:c,hist=/tmp/foo) to place the db inside the vm instead


"frequently" asked questions

  • is it possible to block read-access to folders unless you know the exact URL for a particular file inside?

    • yes, using the g permission, see the examples there
    • you can also do this with linux filesystem permissions; chmod 111 music will make it possible to access files and folders inside the music folder but not list the immediate contents -- also works with other software, not just copyparty
  • can I make copyparty download a file to my server if I give it a URL?

    • not officially, but there is a terrible hack which makes it possible

accounts and volumes

per-folder, per-user permissions - if your setup is getting complex, consider making a config file instead of using arguments

  • much easier to manage, and you can modify the config at runtime with systemctl reload copyparty or more conveniently using the [reload cfg] button in the control-panel (if logged in as admin)

configuring accounts/volumes with arguments:

  • -a usr:pwd adds account usr with password pwd
  • -v .::r adds current-folder . as the webroot, readable by anyone
    • the syntax is -v src:dst:perm:perm:... so local-path, url-path, and one or more permissions to set
    • granting the same permissions to multiple accounts:
      -v .::r,usr1,usr2:rw,usr3,usr4 = usr1/2 read-only, 3/4 read-write


  • r (read): browse folder contents, download files, download as zip/tar
  • w (write): upload files, move files into this folder
  • m (move): move files/folders from this folder
  • d (delete): delete files/folders
  • g (get): only download files, cannot see folder contents or zip/tar


  • add accounts named u1, u2, u3 with passwords p1, p2, p3: -a u1:p1 -a u2:p2 -a u3:p3
  • make folder /srv the root of the filesystem, read-only by anyone: -v /srv::r
  • make folder /mnt/music available at /music, read-only for u1 and u2, read-write for u3: -v /mnt/music:music:r,u1,u2:rw,u3
    • unauthorized users accessing the webroot can see that the music folder exists, but cannot open it
  • make folder /mnt/incoming available at /inc, write-only for u1, read-move for u2: -v /mnt/incoming:inc:w,u1:rm,u2
    • unauthorized users accessing the webroot can see that the inc folder exists, but cannot open it
    • u1 can open the inc folder, but cannot see the contents, only upload new files to it
    • u2 can browse it and move files from /inc into any folder where u2 has write-access
  • make folder /mnt/ss available at /i, read-write for u1, get-only for everyone else, and enable accesskeys: -v /mnt/ss:i:rw,u1:g:c,fk=4
    • c,fk=4 sets the fk volume-flag to 4, meaning each file gets a 4-character accesskey
    • u1 can upload files, browse the folder, and see the generated accesskeys
    • other users cannot browse the folder, but can access the files if they have the full file URL with the accesskey

the browser

accessing a copyparty server using a web-browser



the main tabs in the ui

  • [๐Ÿ”Ž] search by size, date, path/name, mp3-tags ...
  • [๐Ÿงฏ] unpost: undo/delete accidental uploads
  • [๐Ÿš€] and [๐ŸŽˆ] are the uploaders
  • [๐Ÿ“‚] mkdir: create directories
  • [๐Ÿ“] new-md: create a new markdown document
  • [๐Ÿ“Ÿ] send-msg: either to server-log or into textfiles if --urlform save
  • [๐ŸŽบ] audio-player config options
  • [โš™๏ธ] general client config options


the browser has the following hotkeys (always qwerty)

  • B toggle breadcrumbs / navpane
  • I/K prev/next folder
  • M parent folder (or unexpand current)
  • V toggle folders / textfiles in the navpane
  • G toggle list / grid view
  • T toggle thumbnails / icons
  • ESC close various things
  • ctrl-X cut selected files/folders
  • ctrl-V paste
  • F2 rename selected file/folder
  • when a file/folder is selected (in not-grid-view):
    • Up/Down move cursor
    • shift+Up/Down select and move cursor
    • ctrl+Up/Down move cursor and scroll viewport
    • Space toggle file selection
    • Ctrl-A toggle select all
  • when a textfile is open:
    • I/K prev/next textfile
    • S toggle selection of open file
    • M close textfile
  • when playing audio:
    • J/L prev/next song
    • U/O skip 10sec back/forward
    • 0..9 jump to 0%..90%
    • P play/pause (also starts playing the folder)
    • Y download file
  • when viewing images / playing videos:
    • J/L, Left/Right prev/next file
    • Home/End first/last file
    • S toggle selection
    • R rotate clockwise (shift=ccw)
    • Y download file
    • Esc close viewer
    • videos:
      • U/O skip 10sec back/forward
      • P/K/Space play/pause
      • F fullscreen
      • C continue playing next video
      • V loop
      • M mute
  • when the navpane is open:
    • A/D adjust tree width
  • in the grid view:
    • S toggle multiselect
    • shift+A/D zoom
  • in the markdown editor:
    • ^s save
    • ^h header
    • ^k autoformat table
    • ^u jump to next unicode character
    • ^e toggle editor / preview
    • ^up, ^down jump paragraphs


switching between breadcrumbs or navpane

click the ๐ŸŒฒ or pressing the B hotkey to toggle between breadcrumbs path (default), or a navpane (tree-browser sidebar thing)

  • [+] and [-] (or hotkeys A/D) adjust the size
  • [๐ŸŽฏ] jumps to the currently open folder
  • [๐Ÿ“ƒ] toggles between showing folders and textfiles
  • [๐Ÿ“Œ] shows the name of all parent folders in a docked panel
  • [a] toggles automatic widening as you go deeper
  • [โ†ต] toggles wordwrap
  • [๐Ÿ‘€] show full name on hover (if wordwrap is off)


press g to toggle grid-view instead of the file listing, and t toggles icons / thumbnails


it does static images with Pillow / pyvips / FFmpeg, and uses FFmpeg for video files, so you may want to --no-thumb or maybe just --no-vthumb depending on how dangerous your users are

  • pyvips is 3x faster than Pillow, Pillow is 3x faster than FFmpeg
  • disable thumbnails for specific volumes with volflag dthumb for all, or dvthumb / dathumb / dithumb for video/audio/images only

audio files are covnerted into spectrograms using FFmpeg unless you --no-athumb (and some FFmpeg builds may need --th-ff-swr)

images with the following names (see --th-covers) become the thumbnail of the folder they're in: folder.png, folder.jpg, cover.png, cover.jpg

in the grid/thumbnail view, if the audio player panel is open, songs will start playing when clicked

  • indicated by the audio files having the โ–ถ icon instead of ๐Ÿ’พ

zip downloads

download folders (or file selections) as zip or tar files

select which type of archive you want in the [โš™๏ธ] config tab:

name url-suffix description
tar ?tar plain gnutar, works great with curl | tar -xv
zip ?zip=utf8 works everywhere, glitchy filenames on win7 and older
zip_dos ?zip traditional cp437 (no unicode) to fix glitchy filenames
zip_crc ?zip=crc cp437 with crc32 computed early for truly ancient software
  • hidden files (dotfiles) are excluded unless -ed
    • up2k.db and dir.txt is always excluded
  • zip_crc will take longer to download since the server has to read each file twice
    • this is only to support MS-DOS PKZIP v2.04g (october 1993) and older
      • how are you accessing copyparty actually

you can also zip a selection of files or folders by clicking them in the browser, that brings up a selection editor and zip button in the bottom right



drag files/folders into the web-browser to upload

this initiates an upload using up2k; there are two uploaders available:

  • [๐ŸŽˆ] bup, the basic uploader, supports almost every browser since netscape 4.0
  • [๐Ÿš€] up2k, the fancy one

you can also undo/delete uploads by using [๐Ÿงฏ] unpost

up2k has several advantages:

  • you can drop folders into the browser (files are added recursively)
  • files are processed in chunks, and each chunk is checksummed
    • uploads autoresume if they are interrupted by network issues
    • uploads resume if you reboot your browser or pc, just upload the same files again
    • server detects any corruption; the client reuploads affected chunks
    • the client doesn't upload anything that already exists on the server
  • much higher speeds than ftp/scp/tarpipe on some internet connections (mainly american ones) thanks to parallel connections
  • the last-modified timestamp of the file is preserved

see up2k for details on how it works


protip: you can avoid scaring away users with contrib/plugins/minimal-up2k.html which makes it look much simpler

protip: if you enable favicon in the [โš™๏ธ] settings tab (by typing something into the textbox), the icon in the browser tab will indicate upload progress

the up2k UI is the epitome of polished inutitive experiences:

  • "parallel uploads" specifies how many chunks to upload at the same time
  • [๐Ÿƒ] analysis of other files should continue while one is uploading
  • [๐Ÿ’ญ] ask for confirmation before files are added to the queue
  • [๐Ÿ’ค] sync uploading between other copyparty browser-tabs so only one is active
  • [๐Ÿ”Ž] switch between upload and file-search mode
    • ignore [๐Ÿ”Ž] if you add files by dragging them into the browser

and then theres the tabs below it,

  • [ok] is the files which completed successfully
  • [ng] is the ones that failed / got rejected (already exists, ...)
  • [done] shows a combined list of [ok] and [ng], chronological order
  • [busy] files which are currently hashing, pending-upload, or uploading
    • plus up to 3 entries each from [done] and [que] for context
  • [que] is all the files that are still queued

note that since up2k has to read each file twice, [๐ŸŽˆ bup] can theoretically be up to 2x faster in some extreme cases (files bigger than your ram, combined with an internet connection faster than the read-speed of your HDD, or if you're uploading from a cuo2duo)

if you are resuming a massive upload and want to skip hashing the files which already finished, you can enable turbo in the [โš™๏ธ] config tab, but please read the tooltip on that button


dropping files into the browser also lets you see if they exist on the server


when you drag/drop files into the browser, you will see two dropzones: Upload and Search

on a phone? toggle the [๐Ÿ”Ž] switch green before tapping the big yellow Search button to select your files

the files will be hashed on the client-side, and each hash is sent to the server, which checks if that file exists somewhere

files go into [ok] if they exist (and you get a link to where it is), otherwise they land in [ng]

  • the main reason filesearch is combined with the uploader is cause the code was too spaghetti to separate it out somewhere else, this is no longer the case but now i've warmed up to the idea too much


undo/delete accidental uploads


you can unpost even if you don't have regular move/delete access, however only for files uploaded within the past --unpost seconds (default 12 hours) and the server must be running with -e2d

file manager

cut/paste, rename, and delete files/folders (if you have permission)

file selection: click somewhere on the line (not the link itsef), then:

  • space to toggle

  • up/down to move

  • shift-up/down to move-and-select

  • ctrl-shift-up/down to also scroll

  • cut: select some files and ctrl-x

  • paste: ctrl-v in another folder

  • rename: F2

you can move files across browser tabs (cut in one tab, paste in another)

batch rename

select some files and press F2 to bring up the rename UI


quick explanation of the buttons,

  • [โœ… apply rename] confirms and begins renaming
  • [โŒ cancel] aborts and closes the rename window
  • [โ†บ reset] reverts any filename changes back to the original name
  • [decode] does a URL-decode on the filename, fixing stuff like & and %20
  • [advanced] toggles advanced mode

advanced mode: rename files based on rules to decide the new names, based on the original name (regex), or based on the tags collected from the file (artist/title/...), or a mix of both

in advanced mode,

  • [case] toggles case-sensitive regex
  • regex is the regex pattern to apply to the original filename; any files which don't match will be skipped
  • format is the new filename, taking values from regex capturing groups and/or from file tags
    • very loosely based on foobar2000 syntax
  • presets lets you save rename rules for later

available functions:

  • $lpad(text, length, pad_char)
  • $rpad(text, length, pad_char)


say you have a file named meganeko - Eclipse - 07 Sirius A.mp3 (absolutely fantastic album btw) and the tags are: Album:Eclipse, Artist:meganeko, Title:Sirius A, tn:7

you could use just regex to rename it:

  • regex = (.*) - (.*) - ([0-9]{2}) (.*)
  • format = (3). (1) - (4)
  • output = 07. meganeko - Sirius A.mp3

or you could use just tags:

  • format = $lpad((tn),2,0). (artist) - (title).(ext)
  • output = 7. meganeko - Sirius A.mp3

or a mix of both:

  • regex = - ([0-9]{2})
  • format = (1). (artist) - (title).(ext)
  • output = 07. meganeko - Sirius A.mp3

the metadata keys you can use in the format field are the ones in the file-browser table header (whatever is collected with -mte and -mtp)

markdown viewer

and there are two editors


  • the document preview has a max-width which is the same as an A4 paper when printed

other tricks

  • you can link a particular timestamp in an audio file by adding it to the URL, such as &20 / &20s / &1m20 / &t=1:20 after the .../#af-c8960dab

  • enabling the audio equalizer can help make gapless albums fully gapless in some browsers (chrome), so consider leaving it on with all the values at zero

  • get a plaintext file listing by adding ?ls=t to a URL, or a compact colored one with ?ls=v (for unix terminals)

  • if you are using media hotkeys to switch songs and are getting tired of seeing the OSD popup which Windows doesn't let you disable, consider

  • click the bottom-left ฯ€ to open a javascript prompt for debugging

  • files named .prologue.html / .epilogue.html will be rendered before/after directory listings unless --no-logues

  • files named / will be rendered after directory listings unless --no-readme (but .epilogue.html takes precedence)


search by size, date, path/name, mp3-tags, ...


when started with -e2dsa copyparty will scan/index all your files. This avoids duplicates on upload, and also makes the volumes searchable through the web-ui:

  • make search queries by size/date/directory-path/filename, or...
  • drag/drop a local file to see if the same contents exist somewhere on the server, see file-search

path/name queries are space-separated, AND'ed together, and words are negated with a - prefix, so for example:

  • path: shibayan -bossa finds all files where one of the folders contain shibayan but filters out any results where bossa exists somewhere in the path
  • name: demetori styx gives you good stuff

add the argument -e2ts to also scan/index tags from music files, which brings us over to:

server config

using arguments or config files, or a mix of both:

  • config files (-c some.conf) can set additional commandline arguments; see ./docs/example.conf
  • kill -s USR1 (same as systemctl reload copyparty) to reload accounts and volumes from config files without restarting
    • or click the [reload cfg] button in the control-panel when logged in as admin


an FTP server can be started using --ftp 3921, and/or --ftps for explicit TLS (ftpes)

  • based on pyftpdlib
  • needs a dedicated port (cannot share with the HTTP/HTTPS API)
  • uploads are not resumable -- delete and restart if necessary
  • runs in active mode by default, you probably want --ftp-pr 12000-13000
    • if you enable both ftp and ftps, the port-range will be divided in half
    • some older software (filezilla on debian-stable) cannot passive-mode with TLS

file indexing

file indexing relies on two database tables, the up2k filetree (-e2d) and the metadata tags (-e2t), stored in .hist/up2k.db. Configuration can be done through arguments, volume flags, or a mix of both.

through arguments:

  • -e2d enables file indexing on upload
  • -e2ds also scans writable folders for new files on startup
  • -e2dsa also scans all mounted volumes (including readonly ones)
  • -e2t enables metadata indexing on upload
  • -e2ts also scans for tags in all files that don't have tags yet
  • -e2tsr also deletes all existing tags, doing a full reindex

the same arguments can be set as volume flags, in addition to d2d, d2ds, d2t, d2ts for disabling:

  • -v ~/music::r:c,e2dsa,e2tsr does a full reindex of everything on startup
  • -v ~/music::r:c,d2d disables all indexing, even if any -e2* are on
  • -v ~/music::r:c,d2t disables all -e2t* (tags), does not affect -e2d*
  • -v ~/music::r:c,d2ds disables on-boot scans; only index new uploads
  • -v ~/music::r:c,d2ts same except only affecting tags


  • the parser can finally handle c,e2dsa,e2tsr so you no longer have to c,e2dsa:c,e2tsr
  • e2tsr is probably always overkill, since e2ds/e2dsa would pick up any file modifications and e2ts would then reindex those, unless there is a new copyparty version with new parsers and the release note says otherwise
  • the rescan button in the admin panel has no effect unless the volume has -e2ds or higher

to save some time, you can provide a regex pattern for filepaths to only index by filename/path/size/last-modified (and not the hash of the file contents) by setting --no-hash \.iso$ or the volume-flag :c,nohash=\.iso$, this has the following consequences:

  • initial indexing is way faster, especially when the volume is on a network disk
  • makes it impossible to file-search
  • if someone uploads the same file contents, the upload will not be detected as a dupe, so it will not get symlinked or rejected

similarly, you can fully ignore files/folders using --no-idx [...] and :c,noidx=\.iso$

if you set --no-hash [...] globally, you can enable hashing for specific volumes using flag :c,nohash=

upload rules

set upload rules using volume flags, some examples:

  • :c,sz=1k-3m sets allowed filesize between 1 KiB and 3 MiB inclusive (suffixes: b, k, m, g)
  • :c,nosub disallow uploading into subdirectories; goes well with rotn and rotf:
  • :c,rotn=1000,2 moves uploads into subfolders, up to 1000 files in each folder before making a new one, two levels deep (must be at least 1)
  • :c,rotf=%Y/%m/%d/%H enforces files to be uploaded into a structure of subfolders according to that date format
    • if someone uploads to /foo/bar the path would be rewritten to /foo/bar/2021/08/06/23 for example
    • but the actual value is not verified, just the structure, so the uploader can choose any values which conform to the format string
      • just to avoid additional complexity in up2k which is enough of a mess already
  • :c,lifetime=300 delete uploaded files when they become 5 minutes old

you can also set transaction limits which apply per-IP and per-volume, but these assume -j 1 (default) otherwise the limits will be off, for example -j 4 would allow anywhere between 1x and 4x the limits you set depending on which processing node the client gets routed to

  • :c,maxn=250,3600 allows 250 files over 1 hour from each IP (tracked per-volume)
  • :c,maxb=1g,300 allows 1 GiB total over 5 minutes from each IP (tracked per-volume)

compress uploads

files can be autocompressed on upload, either on user-request (if config allows) or forced by server-config

  • volume flag gz allows gz compression
  • volume flag xz allows lzma compression
  • volume flag pk forces compression on all files
  • url parameter pk requests compression with server-default algorithm
  • url parameter gz or xz requests compression with a specific algorithm
  • url parameter xz requests xz compression

things to note,

  • the gz and xz arguments take a single optional argument, the compression level (range 0 to 9)
  • the pk volume flag takes the optional argument ALGORITHM,LEVEL which will then be forced for all uploads, for example gz,9 or xz,0
  • default compression is gzip level 9
  • all upload methods except up2k are supported
  • the files will be indexed after compression, so dupe-detection and file-search will not work as expected

some examples,

  • -v inc:inc:w:c,pk=xz,0
    folder named inc, shared at inc, write-only for everyone, forces xz compression at level 0
  • -v inc:inc:w:c,pk
    same write-only inc, but forces gz compression (default) instead of xz
  • -v inc:inc:w:c,gz
    allows (but does not force) gz compression if client uploads to /inc?pk or /inc?gz or /inc?gz=4

database location

in-volume (.hist/up2k.db, default) or somewhere else

copyparty creates a subfolder named .hist inside each volume where it stores the database, thumbnails, and some other stuff

this can instead be kept in a single place using the --hist argument, or the hist= volume flag, or a mix of both:

  • --hist ~/.cache/copyparty -v ~/music::r:c,hist=- sets ~/.cache/copyparty as the default place to put volume info, but ~/music gets the regular .hist subfolder (- restores default behavior)


  • markdown edits are always stored in a local .hist subdirectory
  • on windows the volflag path is cyglike, so /c/temp means C:\temp but use regular paths for --hist
    • you can use cygpaths for volumes too, -v C:\Users::r and -v /c/users::r both work

metadata from audio files

set -e2t to index tags on upload

-mte decides which tags to index and display in the browser (and also the display order), this can be changed per-volume:

  • -v ~/music::r:c,mte=title,artist indexes and displays title followed by artist

if you add/remove a tag from mte you will need to run with -e2tsr once to rebuild the database, otherwise only new files will be affected

but instead of using -mte, -mth is a better way to hide tags in the browser: these tags will not be displayed by default, but they still get indexed and become searchable, and users can choose to unhide them in the [โš™๏ธ] config pane

-mtm can be used to add or redefine a metadata mapping, say you have media files with foo and bar tags and you want them to display as qux in the browser (preferring foo if both are present), then do -mtm qux=foo,bar and now you can -mte artist,title,qux

tags that start with a . such as .bpm and .dur(ation) indicate numeric value

see the beautiful mess of a dictionary in for the default mappings (should cover mp3,opus,flac,m4a,wav,aif,)

--no-mutagen disables Mutagen and uses FFprobe instead, which...

  • is about 20x slower than Mutagen
  • catches a few tags that Mutagen doesn't
    • melodic key, video resolution, framerate, pixfmt
  • avoids pulling any GPL code into copyparty
  • more importantly runs FFprobe on incoming files which is bad if your FFmpeg has a cve

file parser plugins

provide custom parsers to index additional tags, also see ./bin/mtag/

copyparty can invoke external programs to collect additional metadata for files using mtp (either as argument or volume flag), there is a default timeout of 30sec

  • -mtp .bpm=~/bin/ will execute ~/bin/ with the audio file as argument 1 to provide the .bpm tag, if that does not exist in the audio metadata
  • -mtp key=f,t5,~/bin/ uses ~/bin/ to get the key tag, replacing any existing metadata tag (f,), aborting if it takes longer than 5sec (t5,)
  • -v ~/music::r:c,mtp=.bpm=~/bin/,mtp=key=f,t5,~/bin/ both as a per-volume config wow this is getting ugly

but wait, there's more! -mtp can be used for non-audio files as well using the a flag: ay only do audio files, an only do non-audio files, or ad do all files (d as in dontcare)

  • -mtp ext=an,~/bin/ runs ~/bin/ to get the ext tag only if file is not audio (an)
  • -mtp arch,built,ver,orig=an,eexe,edll,~/bin/ runs ~/bin/ to get properties about windows-binaries only if file is not audio (an) and file extension is exe or dll

upload events

trigger a script/program on each upload like so:

-v /mnt/inc:inc:w:c,mte=+a1:c,mtp=a1=ad,/usr/bin/notify-send

so filesystem location /mnt/inc shared at /inc, write-only for everyone, appending a1 to the list of tags to index, and using /usr/bin/notify-send to "provide" that tag

that'll run the command notify-send with the path to the uploaded file as the first and only argument (so on linux it'll show a notification on-screen)

note that it will only trigger on new unique files, not dupes

and it will occupy the parsing threads, so fork anything expensive, or if you want to intentionally queue/singlethread you can combine it with --mtag-mt 1

if this becomes popular maybe there should be a less janky way to do it actually

hiding from google

tell search engines you dont wanna be indexed, either using the good old robots.txt or through copyparty settings:

  • --no-robots adds HTTP (X-Robots-Tag) and HTML (<meta>) headers with noindex, nofollow globally
  • volume-flag [...]:c,norobots does the same thing for that single volume
  • volume-flag [...]:c,robots ALLOWS search-engine crawling for that volume, even if --no-robots is set globally

also, --force-js disables the plain HTML folder listing, making things harder to parse for search engines


you can change the default theme with --theme 2, and add your own themes by modifying browser.css or providing your own css to --css-browser, then telling copyparty they exist by increasing --themes

0. classic dark 2. flat pm-monokai 4. vice
1. classic light 3. flat light 5. hotdog stand

the classname of the HTML tag is set according to the selected theme, which is used to set colors as css variables ++

  • each theme generally has a dark theme (even numbers) and a light theme (odd numbers), showing in pairs
  • the first theme (theme 0 and 1) is html.a, second theme (2 and 3) is html.b
  • if a light theme is selected, html.y is set, otherwise html.z is
  • so if the dark edition of the 2nd theme is selected, you use any of html.b, html.z, to specify rules

see the top of ./copyparty/web/browser.css where the color variables are set, and there's layout-specific stuff near the bottom

complete examples

  • read-only music server with bpm and key scanning
    python -v /mnt/nas/music:/music:r -e2dsa -e2ts -mtp .bpm=f, -mtp key=f,

browser support

TLDR: yes


ie = internet-explorer, ff = firefox, c = chrome, iOS = iPhone/iPad, Andr = Android

feature ie6 ie9 ie10 ie11 ff 52 c 49 iOS Andr
browse files yep yep yep yep yep yep yep yep
thumbnail view - yep yep yep yep yep yep yep
basic uploader yep yep yep yep yep yep yep yep
up2k - - *1 *1 yep yep yep yep
make directory yep yep yep yep yep yep yep yep
send message yep yep yep yep yep yep yep yep
set sort order - yep yep yep yep yep yep yep
zip selection - yep yep yep yep yep yep yep
file rename - yep yep yep yep yep yep yep
file cut/paste - yep yep yep yep yep yep yep
navpane - yep yep yep yep yep yep yep
image viewer - yep yep yep yep yep yep yep
video player - yep yep yep yep yep yep yep
markdown editor - - yep yep yep yep yep yep
markdown viewer - yep yep yep yep yep yep yep
play mp3/m4a - yep yep yep yep yep yep yep
play ogg/opus - - - - yep yep *3 yep
= feature = ie6 ie9 ie10 ie11 ff 52 c 49 iOS Andr
  • internet explorer 6 to 8 behave the same
  • firefox 52 and chrome 49 are the final winxp versions
  • *1 yes, but extremely slow (ie10: 1 MiB/s, ie11: 270 KiB/s)
  • *3 iOS 11 and newer, opus only, and requires FFmpeg on the server

quick summary of more eccentric web-browsers trying to view a directory index:

browser will it blend
links (2.21/macports) can browse, login, upload/mkdir/msg
lynx (2.8.9/macports) can browse, login, upload/mkdir/msg
w3m (0.5.3/macports) can browse, login, upload at 100kB/s, mkdir/msg
netsurf (3.10/arch) is basically ie6 with much better css (javascript has almost no effect)
opera (11.60/winxp) OK: thumbnails, image-viewer, zip-selection, rename/cut/paste. NG: up2k, navpane, markdown, audio
ie4 and netscape 4.0 can browse, upload with ?b=u, auth with &pw=wark
ncsa mosaic 2.7 does not get a pass, pic1 - pic2
SerenityOS (7e98457) hits a page fault, works with ?b=u, file upload not-impl

client examples

interact with copyparty using non-browser clients

  • javascript: dump some state into a file (two separate examples)

    • await fetch('//', {method:"PUT", body: JSON.stringify(foo)});
    • var xhr = new XMLHttpRequest();'POST', '//'); xhr.send('foo');
  • curl/wget: upload some files (post=file, chunk=stdin)

    • post(){ curl -b cppwd=wark -F act=bput -F f=@"$1";}
      post movie.mkv
    • post(){ wget --header='Cookie: cppwd=wark' --post-file="$1" -O-;}
      post movie.mkv
    • chunk(){ curl -b cppwd=wark -T-;}
      chunk <movie.mkv
  • bash: when curl and wget is not available or too boring

    • (printf 'PUT /junk?pw=wark HTTP/1.1\r\n\r\n'; cat movie.mkv) | nc 3923
    • (printf 'PUT / HTTP/1.1\r\n\r\n'; cat movie.mkv) >/dev/tcp/
  • python: is a command-line up2k client (webm)

  • FUSE: mount a copyparty server as a local filesystem

  • sharex (screenshot utility): see ./contrib/sharex.sxcu

copyparty returns a truncated sha512sum of your PUT/POST as base64; you can generate the same checksum locally to verify uplaods:

b512(){ printf "$((sha512sum||shasum -a512)|sed -E 's/ .*//;s/(..)/\\x\1/g')"|base64|tr '+/' '-_'|head -c44;}
b512 <movie.mkv

you can provide passwords using cookie cppwd=hunter2, as a url query ?pw=hunter2, or with basic-authentication (either as the username or password)


quick outline of the up2k protocol, see uploading for the web-client

  • the up2k client splits a file into an "optimal" number of chunks
    • 1 MiB each, unless that becomes more than 256 chunks
    • tries 1.5M, 2M, 3, 4, 6, ... until <= 256 chunks or size >= 32M
  • client posts the list of hashes, filename, size, last-modified
  • server creates the wark, an identifier for this upload
    • sha512( salt + filesize + chunk_hashes )
    • and a sparse file is created for the chunks to drop into
  • client uploads each chunk
    • header entries for the chunk-hash and wark
    • server writes chunks into place based on the hash
  • client does another handshake with the hashlist; server replies with OK or a list of chunks to reupload

up2k has saved a few uploads from becoming corrupted in-transfer already; caught an android phone on wifi redhanded in wireshark with a bitflip, however bup with https would probably have noticed as well (thanks to tls also functioning as an integrity check)

why chunk-hashes

a single sha512 would be better, right?

this is due to crypto.subtle not providing a streaming api (or the option to seed the sha512 hasher with a starting hash)

as a result, the hashes are much less useful than they could have been (search the server by sha512, provide the sha512 in the response http headers, ...)

hashwasm would solve the streaming issue but reduces hashing speed for sha512 (xxh128 does 6 GiB/s), and it would make old browsers and iphones unsupported


defaults are usually fine - expect 8 GiB/s download, 1 GiB/s upload

below are some tweaks roughly ordered by usefulness:

  • -q disables logging and can help a bunch, even when combined with -lo to redirect logs to file

  • --http-only or --https-only (unless you want to support both protocols) will reduce the delay before a new connection is established

  • --hist pointing to a fast location (ssd) will make directory listings and searches faster when -e2d or -e2t is set

  • --no-hash . when indexing a network-disk if you don't care about the actual filehashes and only want the names/tags searchable

  • -j enables multiprocessing (actual multithreading) and can make copyparty perform better in cpu-intensive workloads, for example:

    • huge amount of short-lived connections
    • really heavy traffic (downloads/uploads)

    ...however it adds an overhead to internal communication so it might be a net loss, see if it works 4 u


when uploading files,

  • chrome is recommended, at least compared to firefox:

    • up to 90% faster when hashing, especially on SSDs
    • up to 40% faster when uploading over extremely fast internets
    • but can be 40% faster than chrome again
  • if you're cpu-bottlenecked, or the browser is maxing a cpu core:

    • up to 30% faster uploads if you hide the upload status list by switching away from the [๐Ÿš€] up2k ui-tab (or closing it)
      • switching to another browser-tab also works, the favicon will update every 10 seconds in that case
    • unlikely to be a problem, but can happen when uploding many small files, or your internet is too fast, or PC too slow


some notes on hardening

  • option -s is a shortcut to set the following options:

    • --no-thumb disables thumbnails and audio transcoding to stop copyparty from running FFmpeg/Pillow/VIPS on uploaded files, which is a good idea if anonymous upload is enabled
    • --no-mtag-ff uses mutagen to grab music tags instead of FFmpeg, which is safer and faster but less accurate
    • --dotpart hides uploads from directory listings while they're still incoming
    • --no-robots and --force-js makes life harder for crawlers, see hiding from google
  • option -ss is a shortcut for the above plus:

    • --no-logues and --no-readme disables support for readme's and prologues / epilogues in directory listings, which otherwise lets people upload arbitrary <script> tags
    • --unpost 0, --no-del, --no-mv disables all move/delete support
    • --hardlink creates hardlinks instead of symlinks when deduplicating uploads, which is less maintenance
      • however note if you edit one file it will also affect the other copies
    • --vague-403 returns a "404 not found" instead of "403 forbidden" which is a common enterprise meme
    • --nih removes the server hostname from directory listings
  • option -sss is a shortcut for the above plus:

    • -lo cpp-%Y-%m%d-%H%M%S.txt.xz enables logging to disk
    • -ls **,*,ln,p,r does a scan on startup for any dangerous symlinks

other misc notes:

  • you can disable directory listings by giving permission g instead of r, only accepting direct URLs to files
    • combine this with volume-flag c,fk to generate per-file accesskeys; users which have full read-access will then see URLs with ?k=... appended to the end, and g users must provide that URL including the correct key to avoid a 404


behavior that might be unexpected

  • users without read-access to a folder can still see the .prologue.html / .epilogue.html / contents, for the purpose of showing a description on how to use the uploader for example

recovering from crashes

client crashes

frefox wsod

firefox 87 can crash during uploads -- the entire browser goes, including all other browser tabs, everything turns white

however you can hit F12 in the up2k tab and use the devtools to see how far you got in the uploads:

  • get a complete list of all uploads, organized by statuts (ok / no-good / busy / queued):
    var tabs = { ok:[], ng:[], bz:[], q:[] }; for (var a of tabs[].push(a); tabs

  • list of filenames which failed:
    โ€‹var ng = []; for (var a of if ( != 'ok') ng.push('<a href=\"').slice(-1)[0].split('\">')[0]); ng

  • send the list of filenames to copyparty for safekeeping:
    await fetch('/inc', {method:'PUT', body:JSON.stringify(ng,null,1)})


  • table-column params = URL parameters; ?foo=bar&qux=...
  • table-column body = POST payload
  • method jPOST = json post
  • method mPOST = multipart post
  • method uPOST = url-encoded post
  • FILE = conventional HTTP file upload entry (rfc1867 et al, filename in Content-Disposition)

authenticate using header Cookie: cppwd=foo or url param &pw=foo


method params result
GET ?ls list files/folders at URL as JSON
GET ?ls&dots list files/folders at URL as JSON, including dotfiles
GET ?ls=t list files/folders at URL as plaintext
GET ?ls=v list files/folders at URL, terminal-formatted
GET ?b list files/folders at URL as simplified HTML
GET ?tree=. list one level of subdirectories inside URL
GET ?tree list one level of subdirectories for each level until URL
GET ?tar download everything below URL as a tar file
GET ?zip=utf-8 download everything below URL as a zip file
GET ?ups show recent uploads from your IP
GET ?ups&filter=f ...where URL contains f
GET ?mime=foo specify return mimetype foo
GET ?raw get markdown file at URL as plaintext
GET ?txt get file at URL as plaintext
GET ?txt=iso-8859-1 ...with specific charset
GET ?th get image/video at URL as thumbnail
GET ?th=opus convert audio file to 128kbps opus
GET ?th=caf the iOS-proprietary container
method body result
jPOST {"q":"foo"} do a server-wide search; see the [๐Ÿ”Ž] search tab raw field for syntax
method params body result
jPOST ?tar ["foo","bar"] download folders foo and bar inside URL as a tar file


method params result
GET ?move=/foo/bar move/rename the file/folder at URL to /foo/bar
method params body result
PUT (binary data) upload into file at URL
PUT ?gz (binary data) compress with gzip and write into file at URL
PUT ?xz (binary data) compress with xz and write into file at URL
mPOST act=bput, f=FILE upload FILE into the folder at URL
mPOST ?j act=bput, f=FILE ...and reply with json
mPOST act=mkdir, name=foo create directory foo at URL
GET ?delete delete URL recursively
jPOST ?delete ["/foo","/bar"] delete /foo and /bar recursively
uPOST msg=foo send message foo into server log
mPOST act=tput, body=TEXT overwrite markdown document at URL

server behavior of msg can be reconfigured with --urlform


method params result
GET ?reload=cfg reload config files and rescan volumes
GET ?scan initiate a rescan of the volume which provides URL
GET ?stack show a stacktrace of all threads


method params result
GET ?pw=x logout


mandatory deps:

  • jinja2 (is built into the SFX)

optional dependencies

install these to enable bonus features

enable ftp-server:

  • for just plaintext FTP, pyftpdlib (is built into the SFX)
  • with TLS encryption, pyftpdlib pyopenssl

enable music tags:

  • either mutagen (fast, pure-python, skips a few tags, makes copyparty GPL? idk)
  • or ffprobe (20x slower, more accurate, possibly dangerous depending on your distro and users)

enable thumbnails of...

  • images: Pillow and/or pyvips and/or ffmpeg (requires py2.7 or py3.5+)
  • videos/audio: ffmpeg and ffprobe somewhere in $PATH
  • HEIF pictures: pyvips or ffmpeg or pyheif-pillow-opener (requires Linux or a C compiler)
  • AVIF pictures: pyvips or ffmpeg or pillow-avif-plugin
  • JPEG XL pictures: pyvips or ffmpeg

pyvips gives higher quality thumbnails than Pillow and is 320% faster, using 270% more ram: sudo apt install libvips42 && python3 -m pip install --user -U pyvips

install recommended deps

python -m pip install --user -U jinja2 mutagen Pillow

optional gpl stuff

some bundled tools have copyleft dependencies, see ./bin/#mtag

these are standalone programs and will never be imported / evaluated by copyparty, and must be enabled through -mtp configs


the self-contained "binary" will unpack itself and run copyparty, assuming you have python installed of course

sfx repack

reduce the size of an sfx by removing features

if you don't need all the features, you can repack the sfx and save a bunch of space; all you need is an sfx and a copy of this repo (nothing else to download or build, except if you're on windows then you need msys2 or WSL)

  • 393k size of original as of v1.1.3
  • 310k after ./scripts/ re no-cm
  • 269k after ./scripts/ re no-cm no-hl

the features you can opt to drop are

  • cm/easymde, the "fancy" markdown editor, saves ~82k
  • hl, prism, the syntax hilighter, saves ~41k
  • fnt, source-code-pro, the monospace font, saves ~9k
  • dd, the custom mouse cursor for the media player tray tab, saves ~2k

for the repack to work, first run one of the sfx'es once to unpack it

note: you can also just download and run scripts/ -- this will grab the latest copyparty release from github and do a few repacks; works on linux/macos (and windows with msys2 or WSL)

install on android

install Termux (see and then copy-paste this into Termux (long-tap) all at once:

apt update && apt -y full-upgrade && apt update && termux-setup-storage && apt -y install python && python -m ensurepip && python -m pip install --user -U copyparty
echo $?

after the initial setup, you can launch copyparty at any time by running copyparty anywhere in Termux

if you want thumbnails, apt -y install ffmpeg

  • or if you want to use vips instead, apt -y install libvips && python -m pip install --user -U wheel && python -m pip install --user -U pyvips && (cd /data/data/com.termux/files/usr/lib/; ln -s{,.0}; ln -s{,.42})

reporting bugs

ideas for context to include in bug reports

if something broke during an upload (replacing FILENAME with a part of the filename that broke):

journalctl -aS '48 hour ago' -u copyparty | grep -C10 FILENAME | tee bug.log


dev env setup

you need python 3.9 or newer due to type hints

the rest is mostly optional; if you need a working env for vscode or similar

python3 -m venv .venv
. .venv/bin/activate
pip install jinja2 strip_hints  # MANDATORY
pip install mutagen  # audio metadata
pip install pyftpdlib  # ftp server
pip install Pillow pyheif-pillow-opener pillow-avif-plugin  # thumbnails
pip install black==21.12b0 click==8.0.2 bandit pylint flake8 isort mypy  # vscode tooling

just the sfx

first grab the web-dependencies from a previous sfx (assuming you don't need to modify something in those):

rm -rf copyparty/web/deps
curl -L >
python3 -h
mv /tmp/pe-copyparty/copyparty/web/deps/ copyparty/web/deps/

then build the sfx using any of the following examples:

./scripts/           # regular edition
./scripts/ gz no-cm  # gzip-compressed + no fancy markdown editor

complete release

also builds the sfx so skip the sfx section above

in the scripts folder:

  • run make -C deps-docker to build all dependencies
  • git tag v1.2.3 && git push origin --tags
  • upload to pypi with make-pypi-release.(sh|bat)
  • create github release with
  • create sfx with


roughly sorted by priority

  • nothing! currently

discarded ideas

  • reduce up2k roundtrips
    • start from a chunk index and just go
    • terminate client on bad data
      • not worth the effort, just throw enough conncetions at it
  • single sha512 across all up2k chunks?
    • crypto.subtle cannot into streaming, would have to use hashwasm, expensive
  • separate sqlite table per tag
    • performance fixed by skipping some indexes (+mt.k)
  • audio fingerprinting
    • only makes sense if there can be a wasm client and that doesn't exist yet (except for olaf which is agpl hence counts as not existing)
  • os.copy_file_range for up2k cloning
    • almost never hit this path anyways
  • up2k partials ui
    • feels like there isn't much point
  • cache sha512 chunks on client
    • too dangerous
  • comment field
    • nah
  • look into android thumbnail cache file format
    • absolutely not
  • indexedDB for hashes, cfg enable/clear/sz, 2gb avail, ~9k for 1g, ~4k for 100m, 500k items before autoeviction
    • blank hashlist when up-ok to skip handshake
      • too many confusing side-effects
  • hls framework for Someone Else to drop code into :^)
    • probably not, too much stuff to consider -- seeking, start at offset, task stitching (probably np-hard), conditional passthru, rate-control (especially multi-consumer), session keepalive, cache mgmt...

Release history Release notifications | RSS feed

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

copyparty-1.3.3.tar.gz (516.8 kB view hashes)

Uploaded source

Built Distribution

copyparty-1.3.3-py2.py3-none-any.whl (516.7 kB view hashes)

Uploaded py2 py3

Supported by

AWS AWS Cloud computing Datadog Datadog Monitoring Facebook / Instagram Facebook / Instagram PSF Sponsor Fastly Fastly CDN Google Google Object Storage and Download Analytics Huawei Huawei PSF Sponsor Microsoft Microsoft PSF Sponsor NVIDIA NVIDIA PSF Sponsor Pingdom Pingdom Monitoring Salesforce Salesforce PSF Sponsor Sentry Sentry Error logging StatusPage StatusPage Status page