[{"data":1,"prerenderedAt":514},["ShallowReactive",2],{"nav-docs":3,"nav-api":60,"api-download":89},[4],{"title":5,"path":6,"stem":7,"children":8},"Docs","\u002Fdocs","docs",[9,12,16,20,24,28,32,36,40,44,48,52,56],{"title":10,"path":6,"stem":11},"Installation","docs\u002Findex",{"title":13,"path":14,"stem":15},"Sending files","\u002Fdocs\u002Fsending-files","docs\u002F02.sending-files",{"title":17,"path":18,"stem":19},"Receiving files","\u002Fdocs\u002Freceiving-files","docs\u002F03.receiving-files",{"title":21,"path":22,"stem":23},"Passwords, galleries and backgrounds","\u002Fdocs\u002Fshare-options","docs\u002F04.share-options",{"title":25,"path":26,"stem":27},"Expiry and deletion","\u002Fdocs\u002Fexpiry","docs\u002F05.expiry",{"title":29,"path":30,"stem":31},"Users","\u002Fdocs\u002Fusers","docs\u002F06.users",{"title":33,"path":34,"stem":35},"Configuration","\u002Fdocs\u002Fconfiguration","docs\u002F07.configuration",{"title":37,"path":38,"stem":39},"Colours and branding","\u002Fdocs\u002Fcolors","docs\u002F08.colors",{"title":41,"path":42,"stem":43},"Docker","\u002Fdocs\u002Fdocker","docs\u002F09.docker",{"title":45,"path":46,"stem":47},"API keys","\u002Fdocs\u002Fapi-keys","docs\u002F10.api-keys",{"title":49,"path":50,"stem":51},"MCP server","\u002Fdocs\u002Fmcp-server","docs\u002F11.mcp-server",{"title":53,"path":54,"stem":55},"Troubleshooting","\u002Fdocs\u002Ftroubleshooting","docs\u002F12.troubleshooting",{"title":57,"path":58,"stem":59},"Contributing","\u002Fdocs\u002Fcontributing","docs\u002F13.contributing",[61],{"title":62,"path":63,"stem":64,"children":65},"Api","\u002Fapi","api",[66,69,73,77,81,85],{"title":67,"path":63,"stem":68},"REST API","api\u002Findex",{"title":70,"path":71,"stem":72},"Transfers","\u002Fapi\u002Ftransfers","api\u002F02.transfers",{"title":74,"path":75,"stem":76},"Uploading files","\u002Fapi\u002Fupload","api\u002F03.upload",{"title":78,"path":79,"stem":80},"Sending a transfer","\u002Fapi\u002Fsend","api\u002F04.send",{"title":82,"path":83,"stem":84},"Downloading","\u002Fapi\u002Fdownload","api\u002F05.download",{"title":86,"path":87,"stem":88},"Recipients","\u002Fapi\u002Frecipients","api\u002F06.recipients",{"id":90,"title":82,"body":91,"description":508,"extension":509,"meta":510,"navigation":511,"path":83,"seo":512,"stem":84,"__hash__":513},"api\u002Fapi\u002F05.download.md",{"type":92,"value":93,"toc":500},"minimark",[94,98,107,112,129,332,347,353,357,366,386,389,392,396,405,420,424,433,440,444,453,456,479,486,490,496],[95,96,82],"h1",{"id":97},"downloading",[99,100,101,102,106],"p",{},"These routes take ",[103,104,105],"strong",{},"no API key",". The 32-byte token in the URL is the\ncredential, because recipients are people who have never heard of your instance.",[108,109,111],"h2",{"id":110},"transfer-contents","Transfer contents",[113,114,119],"pre",{"className":115,"code":116,"language":117,"meta":118,"style":118},"language-http shiki shiki-themes github-light github-dark","GET \u002Fapi\u002Fdownload\u002F:token\n","http","",[120,121,122],"code",{"__ignoreMap":118},[123,124,127],"span",{"class":125,"line":126},"line",1,[123,128,116],{},[113,130,134],{"className":131,"code":132,"language":133,"meta":118,"style":118},"language-json shiki shiki-themes github-light github-dark","{\n  \"data\": {\n    \"subject\": \"Proposal & draft contract\",\n    \"message\": \"As discussed — feedback by Friday would be great.\",\n    \"senderName\": \"Florian Strasser\",\n    \"layout\": \"list\",\n    \"locked\": false,\n    \"requiresPassword\": false,\n    \"expiresAt\": \"2026-09-01T10:00:00.000Z\",\n    \"totalSize\": 574464,\n    \"files\": [\n      { \"id\": 41, \"filename\": \"Proposal-2026-118.pdf\", \"size\": 421888, \"isImage\": false }\n    ]\n  }\n}\n","json",[120,135,136,142,152,168,181,194,207,220,232,245,258,267,314,320,326],{"__ignoreMap":118},[123,137,138],{"class":125,"line":126},[123,139,141],{"class":140},"sVt8B","{\n",[123,143,145,149],{"class":125,"line":144},2,[123,146,148],{"class":147},"sj4cs","  \"data\"",[123,150,151],{"class":140},": {\n",[123,153,155,158,161,165],{"class":125,"line":154},3,[123,156,157],{"class":147},"    \"subject\"",[123,159,160],{"class":140},": ",[123,162,164],{"class":163},"sZZnC","\"Proposal & draft contract\"",[123,166,167],{"class":140},",\n",[123,169,171,174,176,179],{"class":125,"line":170},4,[123,172,173],{"class":147},"    \"message\"",[123,175,160],{"class":140},[123,177,178],{"class":163},"\"As discussed — feedback by Friday would be great.\"",[123,180,167],{"class":140},[123,182,184,187,189,192],{"class":125,"line":183},5,[123,185,186],{"class":147},"    \"senderName\"",[123,188,160],{"class":140},[123,190,191],{"class":163},"\"Florian Strasser\"",[123,193,167],{"class":140},[123,195,197,200,202,205],{"class":125,"line":196},6,[123,198,199],{"class":147},"    \"layout\"",[123,201,160],{"class":140},[123,203,204],{"class":163},"\"list\"",[123,206,167],{"class":140},[123,208,210,213,215,218],{"class":125,"line":209},7,[123,211,212],{"class":147},"    \"locked\"",[123,214,160],{"class":140},[123,216,217],{"class":147},"false",[123,219,167],{"class":140},[123,221,223,226,228,230],{"class":125,"line":222},8,[123,224,225],{"class":147},"    \"requiresPassword\"",[123,227,160],{"class":140},[123,229,217],{"class":147},[123,231,167],{"class":140},[123,233,235,238,240,243],{"class":125,"line":234},9,[123,236,237],{"class":147},"    \"expiresAt\"",[123,239,160],{"class":140},[123,241,242],{"class":163},"\"2026-09-01T10:00:00.000Z\"",[123,244,167],{"class":140},[123,246,248,251,253,256],{"class":125,"line":247},10,[123,249,250],{"class":147},"    \"totalSize\"",[123,252,160],{"class":140},[123,254,255],{"class":147},"574464",[123,257,167],{"class":140},[123,259,261,264],{"class":125,"line":260},11,[123,262,263],{"class":147},"    \"files\"",[123,265,266],{"class":140},": [\n",[123,268,270,273,276,278,281,284,287,289,292,294,297,299,302,304,307,309,311],{"class":125,"line":269},12,[123,271,272],{"class":140},"      { ",[123,274,275],{"class":147},"\"id\"",[123,277,160],{"class":140},[123,279,280],{"class":147},"41",[123,282,283],{"class":140},", ",[123,285,286],{"class":147},"\"filename\"",[123,288,160],{"class":140},[123,290,291],{"class":163},"\"Proposal-2026-118.pdf\"",[123,293,283],{"class":140},[123,295,296],{"class":147},"\"size\"",[123,298,160],{"class":140},[123,300,301],{"class":147},"421888",[123,303,283],{"class":140},[123,305,306],{"class":147},"\"isImage\"",[123,308,160],{"class":140},[123,310,217],{"class":147},[123,312,313],{"class":140}," }\n",[123,315,317],{"class":125,"line":316},13,[123,318,319],{"class":140},"    ]\n",[123,321,323],{"class":125,"line":322},14,[123,324,325],{"class":140},"  }\n",[123,327,329],{"class":125,"line":328},15,[123,330,331],{"class":140},"}\n",[99,333,334,335,338,339,342,343,346],{},"When the transfer is password protected and not yet unlocked, ",[120,336,337],{},"locked"," is ",[120,340,341],{},"true","\nand ",[103,344,345],{},"the file list is omitted entirely"," — no names, no sizes, no message. A\nlist of filenames is often as revealing as the files themselves.",[99,348,349,352],{},[120,350,351],{},"isImage"," is decided by the file's own leading bytes, not by its name or the\ntype the uploader declared.",[108,354,356],{"id":355},"unlocking","Unlocking",[113,358,360],{"className":115,"code":359,"language":117,"meta":118,"style":118},"POST \u002Fapi\u002Fdownload\u002F:token\u002Funlock\n",[120,361,362],{"__ignoreMap":118},[123,363,364],{"class":125,"line":126},[123,365,359],{},[113,367,369],{"className":131,"code":368,"language":133,"meta":118,"style":118},"{ \"password\": \"grape\" }\n",[120,370,371],{"__ignoreMap":118},[123,372,373,376,379,381,384],{"class":125,"line":126},[123,374,375],{"class":140},"{ ",[123,377,378],{"class":147},"\"password\"",[123,380,160],{"class":140},[123,382,383],{"class":163},"\"grape\"",[123,385,313],{"class":140},[99,387,388],{},"Sets a cookie scoped to that one transfer. It cannot be carried to another —\nunlocking one protected transfer does not unlock the rest.",[99,390,391],{},"Every attempt counts against the download rate limiter, which is what caps\nonline guessing of a deliberately short share password.",[108,393,395],{"id":394},"one-file","One file",[113,397,399],{"className":115,"code":398,"language":117,"meta":118,"style":118},"GET \u002Fapi\u002Fdownload\u002F:token\u002Ffile\u002F:fileId\n",[120,400,401],{"__ignoreMap":118},[123,402,403],{"class":125,"line":126},[123,404,398],{},[99,406,407,408,411,412,415,416,419],{},"Served as ",[120,409,410],{},"application\u002Foctet-stream"," with the original filename in\n",[120,413,414],{},"Content-Disposition",", so an uploaded ",[120,417,418],{},".html"," cannot execute on your origin.",[108,421,423],{"id":422},"everything-as-a-zip","Everything as a zip",[113,425,427],{"className":115,"code":426,"language":117,"meta":118,"style":118},"GET \u002Fapi\u002Fdownload\u002F:token\u002Fzip\n",[120,428,429],{"__ignoreMap":118},[123,430,431],{"class":125,"line":126},[123,432,426],{},[99,434,435,436,439],{},"Streamed and ",[103,437,438],{},"stored"," rather than compressed. The download starts immediately\ninstead of making the recipient wait while the server packs an archive — and\nmost of what people send is already compressed, so deflating it again would cost\ntime to save nothing.",[108,441,443],{"id":442},"image-previews","Image previews",[113,445,447],{"className":115,"code":446,"language":117,"meta":118,"style":118},"GET \u002Fapi\u002Fdownload\u002F:token\u002Fpreview\u002F:fileId\n",[120,448,449],{"__ignoreMap":118},[123,450,451],{"class":125,"line":126},[123,452,446],{},[99,454,455],{},"The gallery's thumbnails, and the one place an uploaded file is rendered in a\nbrowser rather than saved. It is the strictest endpoint in the app:",[457,458,459,463,470,476],"ul",{},[460,461,462],"li",{},"the leading bytes must match a known raster image signature;",[460,464,465,466,469],{},"the ",[120,467,468],{},"Content-Type"," sent is the one derived from those bytes;",[460,471,472,475],{},[120,473,474],{},"nosniff"," stops the browser second-guessing it;",[460,477,478],{},"a sandbox CSP strips scripting and same-origin privileges regardless.",[99,480,481,482,485],{},"Anything that is not a real image answers ",[120,483,484],{},"404",". SVG is deliberately excluded:\nit is an image, but it is also a document that can carry scripts.",[108,487,489],{"id":488},"expiry","Expiry",[99,491,492,493,495],{},"Every one of these routes refuses an expired transfer the moment it lapses,\nindependently of the scheduled sweep. An expired, deleted or never-existent\ntoken all answer ",[120,494,484],{},", so an old link reveals nothing about what used to be\nthere.",[497,498,499],"style",{},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sVt8B, html code.shiki .sVt8B{--shiki-default:#24292E;--shiki-dark:#E1E4E8}html pre.shiki code .sj4cs, html code.shiki .sj4cs{--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .sZZnC, html code.shiki .sZZnC{--shiki-default:#032F62;--shiki-dark:#9ECBFF}",{"title":118,"searchDepth":144,"depth":144,"links":501},[502,503,504,505,506,507],{"id":110,"depth":144,"text":111},{"id":355,"depth":144,"text":356},{"id":394,"depth":144,"text":395},{"id":422,"depth":144,"text":423},{"id":442,"depth":144,"text":443},{"id":488,"depth":144,"text":489},"These routes take no API key. The 32-byte token in the URL is the\ncredential, because recipients are people who have never heard of your instance.","md",{},true,{"title":82,"description":508},"zsyM0d_pNnpXzQgTURM-KK_0YLXh6E1URQCGiEH2bfU",1790104591923]