Snap 因严格沙箱限制文件系统访问，需要完整访问权限时改用 .deb、.AppImage 或 AUR；macOS 包未签名，Gatekeeper 会拦截，需要右键打开或执行 sudo xattr -rd com.apple.quarantine /Applications/AeroFTP.app；Windows 安装包未做代码签名，SmartScreen 首次运行会告警。
aeroftp
axpdev-labGPL-3.0活跃维护跨平台文件管理器，用 Rust 和 React 构建，通过 70 种连接方式统一接入 FTP、SFTP、WebDAV、S3 及各类云存储等 63 种后端，方便在一个界面里管理分散的远程文件。
Cross-platform file manager: 63 storage backends through 70 connection methods (FTP, FTPS, SFTP, SCP, WebDAV, S3 and native cloud providers), built with Rust 🦀 (Tauri) + React
v4.2.7发布于 2026-11-08 15:39 UTC278star +2 / 7 天18fork同步于 2026-11-10 12:03 UTC
sudo snap install aeroftp
winget install axpnet.AeroFTP 硬件要求按 README 说明
README 未说明 CPU、内存或显存要求；支持 Linux、Windows 10（1709+）和 11、macOS（Intel 与 Apple Silicon），Linux 覆盖 X11 与 Wayland 下的 GNOME、KDE、XFCE、Hyprland、Sway、i3。
支持 Apple Silicon
跨平台文件管理器，用一套界面统一管理 FTP、SFTP、S3 和云存储等 63 种后端
跨平台文件管理器，用 Rust 和 React 构建，通过 70 种连接方式统一接入 FTP、SFTP、WebDAV、S3 及各类云存储等 63 种后端，方便在一个界面里管理分散的远程文件。
核心能力
- 原生支持 FTP、FTPS、SFTP、SCP、WebDAV、S3 等 8 种传输协议
- 为 26 家云服务商提供独立 OAuth2 或 API Key 接入，而非通用适配
- 内置 49 个预配置预设，表单自动填好服务器地址、端口和路径
- FTP 支持显式或隐式 TLS，用 MLSD 列目录，用 REST/APPE 断点续传
- 通过 MTP/WPD 直接访问手机、相机等无盘符便携设备
容易踩的坑
内容由模型根据 README 生成，可能不完整或不准确，以官方文档为准。看原文 README
- v4.2.7AeroFTP v4.2.7最新正式版2026-11-08 · 2026-11-08 15:39 UTC
[4.2.7] - 2026-11-08
Network Trust, Storage Presets and Object Integrity
AeroFTP 4.2.7 introduces Tigris and Fastly Object Storage S3 presets, native MEGAcmd bulk transfers and hardened profile imports. This release enforces URL-parsed network trust, prevents object path escapes, protects modal workflows from accidental backdrop clicks, and ensures transfers and background synchronization stay bound to their target.
The complete change record and remaining follow-ups are in the 4.2.7 release tracker.
Added
- Tigris S3 preset. Connect to Tigris with static endpoints, region auto-detection, atomic metadata rename that protects moved objects, storage usage reporting with fallbacks, soft-deleted version handling in the trash, and rclone export and import (#1512).
- Fastly Object Storage S3 preset. Choose from 12 regional endpoints with path-style addressing, Fastly rclone bridge import and export, 16 MiB single-PUT cutoffs, 8 MiB multipart parts with bounded 408 and 429 retries, SigV4 7-day share link caps, 30-minute AeroCloud scan floors, and session-aware capability switching (#1531).
- Native MEGAcmd bulk transfers. Transfer entire folders and bulk uploads through a single native MEGAcmd invocation with per-file proof, and reduce Proton Drive CLI launches (#1513).
- S3 and WebDAV import security review. Profile imports review and reset insecure options to safe defaults unless explicitly kept, requiring approval for certificate or TLS relaxations (#1524).
Fixed
- Network trust and destination validation are fail-closed. Private, loopback and certificate checks inspect the host reached by URL parsing, S3 keys with dot segments are rejected, and FTP passive connections pin to the control peer unless explicitly opted in (#1524).
- Transfers, Apply and AI uploads stay bound to their target. File operations remain pinned to their initial server, profile, account and crypt scope across tab switches or connection handoffs; unlinked targets and interrupted cuts retain unfinished files (#1526).
- Object names encode exactly once. Spaces,
+,%,#,?and non-ASCII names are encoded once across S3 share links, Filen listings, Azure wire requests and OAuth 1 signatures (#1515). - Relative paths and archive extraction cannot escape targets. Path traversal, link following during local delete or move, and cross-device directory moves are secured against directory escapes, and temporary files remain private (#1528).
- AeroSync and dialogs ignore accidental backdrop clicks. Backdrop clicks no longer close windows holding active transfers or comparison results, and ESC prioritizes the topmost active decision prompt (@456vv, #1527, #1530).
- Peer-L0 replica protects local filesystem boundaries. Replica file writing and deletion refuse symbolic links, operate on verified roots, reject world-writable parent directories, and never remove files outside their own writes (#1529).
- Credential vault writes are protected across processes. Simultaneous saves between the GUI, CLI and MCP services acquire an exclusive cross-process lock with automatic cleanup of orphaned temporary files (#1510).
- Session connection and tab switching isolate credentials. Opening a second saved profile parks the prior session cleanly, connection failures keep tabs intact, and tab switches prevent credential reuse between profiles sharing a username (#1511, #1514).
- rclone bridge carries configuration without loss. Swift passwords are kept within their service, aliases preserve container and drive associations, and nested sections and crypt scopes import reliably (#1516, #1523).
- Error outcomes are decided by codes rather than translated strings. Operational errors evaluate HTTP statuses, OS error codes, markers and listings instead of localized messages (#1517, #1520).
- DEB and RPM package staging supports symlinked Downloads.
- v4.2.6AeroFTP v4.2.62026-11-05 · 2026-11-05 07:14 UTC
查看更新说明
[4.2.6] - 2026-11-05
SCP Support and Reliability Consolidation
AeroFTP now connects to SSH servers without an SFTP subsystem through SCP, including stock OpenWrt devices. This release consolidates transfers, synchronization, credentials and desktop behavior, with stricter handling of uncertain upload outcomes, exact filenames and incomplete comparisons.
The complete change record and remaining follow-ups are in the 4.2.6 release tracker.
Added
- SCP connections and automatic SFTP fallback. Select SCP in Add Services or Quick Connect, or let an SFTP connection continue over SCP when the server has no SFTP subsystem. Both share SSH authentication and host-key verification; SFTP-only profiles can disable fallback. Interrupted SCP uploads restart rather than append, and SCP remains visibly identified in saved profiles (@GWan1234, #1452, #1454, #1456, #1483).
- One-way Update with destination deletes. AeroSync, the CLI and AeroCloud retain newer destination files while propagating deletions; transfer receipts protect untracked or changed AeroCloud files (@EhudKirsh, #347, #1442).
- Profile import choices. Skip, overwrite or duplicate existing profiles in the GUI and with CLI
--on-existing. Profile lists and secrets commit together under a lock and revision, and failed imports roll back (@EhudKirsh, #347, #1440). - AeroSync tools in named tabs. Templates, Multi-Path, Rollback snapshots, Sync journals and Scheduler stay in the AeroSync window beside Compare and Plan (@EhudKirsh, #347, #1437).
- FileLu version operations. List, download, restore and permanently delete earlier versions with identifiers bound to the selected file (#1488).
- Global CLI HTTP timeout.
--timeout SECSshortens HTTP waits, includingsiteandaudit; silent WebDAV listings and metadata requests end after two minutes, and OAuth sign-in requests after 30 seconds (#1439). - AeroSync GUI intents. Sync actions can be requested through the supported GUI controller, with field-specific refusals for invalid input (#1464).
Fixed
- Uncertain cloud writes are not automatically replayed. A timeout or server error after a create or upload no longer blindly repeats a potentially committed operation. Safe bounded retries retain the opened source file, FileLu acknowledgements are validated, and Internxt replacements preserve the existing file. GUI and backend upload loops leave another whole-file attempt to explicit Retry while retaining safe retries within provider operations (#1486).
- Changed upload sources are refused before publication. Azure, Box, Dropbox, Drime, Google Drive, OneDrive, B2 and shared multipart paths abort an upload whose local source changed while being read (#1438, #1463).
- Downloads verify published content hashes. GUI, CLI and sync downloads check usable plaintext SHA-256, SHA-1 or MD5 hashes before reporting success. Segmented mismatches fall back to one stream; settings and CLI flags control the bounded verification (#1467).
- HTTP download failures retain their meaning. An HTTP 412 distinguishes a gateway rejecting
If-Matchfrom an object that changed. pCloud downloads, version downloads and thumbnails reject HTTP error pages instead of saving them as files (#1445, #1489). - Failed transfers fail their queue rows. Retry, pause, reconnect and cancellation observe actual failures, including folders containing failed files. The Progress window keeps its top bar and graph stable throughout a sync (#1446, #1473).
- Upload timestamps converge with Compare. pCloud, Google Drive, OneDrive and Dropbox preserve the source timestamp; other paths remember the destination stamp produced by their own upload, using metadata from the file that supplied the bytes (#1460, #1466).
- Proton Drive preserves literal names. Leading and trailing spaces remain part of filenames, and one rejected upload does not discard valid s
- v4.2.5AeroFTP v4.2.52026-10-28 · 2026-10-28 04:36 UTC
查看更新说明
[4.2.5] - 2026-10-28
Safer Sync, Faster Proton Transfers, and Desktop Reliability
AeroSync preserves literal filenames, matches canonical Unicode names and keeps progress and template settings consistent. Proton Drive transfers make fewer requests and use native bulk operations in more places. Folder downloads can start before scanning finishes, while stricter destination checks prevent ambiguous filenames from overwriting one another. Windows portable updates, desktop file opening, diagnostics and translations receive further repairs.
The complete change record and remaining follow-ups are in the 4.2.5 release tracker.
Added
- Benchmark latency and service recommendations. Signal bars and measured latency help compare services from your own network; a best protocol is named only when two different protocols supplied comparable measurements (@EhudKirsh, #368, #277, #1341, #1361).
- Open any file with AeroFTP. Desktop file opening selects the file in AeroFile and previews images in AeroImage or text in the text preview. Linux integration works again, and files and archives opened during startup are retained (@EhudKirsh, #347, #1359).
Fixed
- AeroAgent diagnostics use the correct approval tier. The GUI classifies compiler and linter diagnostics as medium, matching the backend approval requirement for workspace build scripts and configuration code (#1391).
- Crypt connections open at the configured Remote Path. A landing above an encrypted island stays in plaintext until that island is entered, without visiting it during connection. Saved and Quick Connect paths retain their resolved landing and clear the previous session's frontend vault IDs. If a stored unlock fails when entering the encrypted scope, the locked-overlay banner offers manual recovery. Scope-entry activation retains its connection identity and discards obsolete navigation results after a session switch. Obsolete scope-entry attempts roll back their own activation by connection and activation identity; ordinary root-navigation errors retain best-effort positioning while connection-generation refusals abort activation (#1390, #1391).
- CLI checks request both sides of a checksum comparison.
check --checksumdetects different same-size contents when the provider supplies SHA-256;reconcile --checksum --jsonexposes per-pair comparison methods;checkreports counts and nonmatching details without that field. - AeroSync preserves folders and converged files. Compare retains shared and empty remote directories, S3 implicit parents and typed rclone entries, and skips files that already match while preserving actionable checksum and type conflicts (#1322).
- Literal Unix backslashes remain literal. Recursive uploads, sync, watchers and GUI transfers no longer confuse a backslash in a filename with a nested path. Windows drive and UNC roots remain navigable, remote parent-creation errors are handled, and escaped ignore reinclusions stay reachable (#1324, #1325).
- Canonical Unicode names match without losing their real paths. Compare, watcher events, resume and navigation retain exact object identities, including distinct siblings and rename collisions. Confirmation on the original macOS/SFTP setup remains pending (@bratushkadan, #1326, #1328, #1329).
- AeroSync progress and templates stay consistent. Compare and Plan retain scan progress, queue progress uses the whole plan, and compatible template imports reuse the comparison. Exported templates preserve Update and other Plan settings, reject invalid values and retain 4.2.4 defaults (@EhudKirsh, #347, #1366, #1368, #1372).
- Sync refuses incomplete or ambiguous destinations. AeroCloud does not upload over objects hidden by an incomplete scan; single-file fallback retains versioned backups. GUI and CLI folder downloads reject duplicate, sanitized, case-folded and canonical Unicode aliases instead of ov
- v4.2.4AeroFTP v4.2.42026-10-20 · 2026-10-20 16:55 UTC
查看更新说明
[4.2.4] - 2026-10-20
Native Proton Drive, Headless Profiles, and Bulk Transfers
Proton Drive gains a native client with browser sign-in, encrypted vault sessions, verified transfers and storage quota. Saved profiles can be created and authorized from the GUI, CLI and MCP with the same connection options. Proton CLI compatibility mode groups suitable files into bounded bulk transfers across the CLI, GUI and compatible sync operations. This release also strengthens interrupted transfers, recursive operations, profile backups and archive extraction, and repairs desktop packaging and integration issues.
The complete record of this cycle, including fixes, validation and remaining follow-ups, is in the 4.2.4 release tracker.
Added
- Native Proton Drive. Connect through AeroFTP's own client with browser sign-in, encrypted vault sessions, file and folder operations, revisions, verified downloads, checksums and quota. New profiles choose native mode when available; existing profiles keep official CLI mode until explicitly changed. Small transfers use a single request, large transfers overlap blocks, and revision pages are prefetched (#1293, #1302).
- Bulk transfers in Proton CLI mode. Suitable files share bounded native invocations across the CLI, GUI and compatible sync operations, retaining per-file outcomes, cancellation and verified download publication. Existing resume, delta, checksum and error-correction requirements keep their established paths. MEGAcmd and Filen bulk remain unsupported; remaining wrapper performance work stays open in the release tracker (Requested 71, #1317).
- Headless profile authorization. CLI and MCP can authorize saved profiles through supported OAuth, GitHub Device Flow and GitHub App flows, refresh expired App sessions, and consume supported structured credentials without storing unused seeds. Pending authorization stays encrypted and bound to the intended profile and user (#1305).
- One connection manifest for GUI, CLI and MCP. Profile creation shares aliases, presets, defaults and public options, preserving existing FTP modes and explicit native/CLI Proton choices (#1304).
profile-add --proton-modeandproton sign-in,sign-outandstatusmake native Proton profiles usable headlessly (#1296). - Saved SITE templates. FTP and FTPS profiles can keep commands with text, number and secret slots and run them from the GUI, CLI and TUI. Secret slot values are never saved, and importing the glFTPd catalog preserves existing template names (@jnewing, #1109).
- AeroCloud from saved profiles. Choose a saved connection and the folder under it from a searchable list. Saved S3, B2, Azure, kDrive and OAuth profiles connect through the same profile loading path as the rest of the app (#1231).
- Incremental AeroCloud changes. Local watcher events sync the paths that changed rather than rescanning the remote tree. Providers can require a minimum interval between full scans, and unchanged KeepBoth conflicts no longer create a new conflict copy every cycle (#1283).
- Windows association choices. Setup and Settings independently control AeroFTP format associations and archive/Explorer integration. NSIS
/NOASSOCand MSI feature maintenance preserve disabled choices and other applications' registrations (@pasha-zzz, #454, #1209). - Linux tray and account details. Theme-aware tray icons, sync actions that follow AeroCloud state, saved-profile counts in the account chooser, collapsible AI model groups and a visible controller bar (#1210).
Fixed
- Cross-profile copies reuse saved sign-in and encryption settings. CLI, GUI and agent copies open profiles through their shared authentication path, keep overlay data encrypted on the remote, preserve empty directories and skip equal-size files whose destination is not older. A missing or unreadable source subtree fails the plan instead of reporting an incomple
- v4.2.3AeroFTP v4.2.32026-10-13 · 2026-10-13 02:30 UTC
查看更新说明
[4.2.3] - 2026-10-13
Checked Writes, Resumable Ranges, and SITE Commands
A repair release, one week after 4.2.2: 122 commits and 86 tracked changes. The thread running through it is data you could lose when something goes wrong half way. An operation that checks whether a file exists before writing now writes only when the server confirmed it is not there, a WebDAV replace keeps the old file until the new one is in place,
crypt initwrites nothing until the Emergency Kit is in your hands, and a large download that loses a connection resumes the range it was reading instead of starting over. Around that: SITE commands for FTP and FTPS, a local folder usable wherever the CLI takes a URL, a transfer speed that shows the current speed, and AeroAgent 1.7, which can drive the visible app when you ask it to.Every change listed here is tracked, with its commit and its discussion, in the release tracker: AeroFTP 4.2.3, known issues, patches and updates.
Thank you to everyone who uses AeroFTP, at home or at work, and especially to those who write back when something does not behave. A large part of this release started from a report: benchmark runs from Western Europe that showed MEGA and Proton transfers with no progress, a request for raw SITE commands, a crash report about large uploads that led to the progress and speed rework, and two interface proposals now in the app. The people behind them are listed at the end.
Before the tag, an independent pre-release review read how this cycle's changes fit together on
main, in three areas: writes that can lose data, the transfer engine and its retries, and the security surface, the latter checked against the security advisories rclone published on October 9. A second pass read the fixes that landed after it. Together they found three blockers, all fixed below before the tag; the non-blocking findings are recorded in the tracker.What changes for you
The short version, split by where you meet it. Everything in this list appears again further down with the detail.
In the app
- A failed check no longer leads to a write. Creating a crypt vault, unlocking AeroCrypt, touching a file, and uploading with no-clobber, immutable or "skip existing" write only when the server answered that the item is not there. If the check itself fails (timeout, permission, server error), the operation stops instead of writing over what might be there.
- Replacing a file on WebDAV keeps the old one until the new one is in place. Apache, rclone serve and Nextcloud start an overwriting MOVE by deleting the destination, so a failure in between lost the file. The old file is now set aside, the new one moved in, and only then the old one deleted.
- Large downloads survive a stalled read. When one range of a segmented download stalls or loses its connection, that range resumes from where it stopped instead of the whole file starting again, on SFTP, FTP, S3 and every HTTP provider with ranged reads.
- The speed you see is the current one. Speed, graph and time remaining follow the last 3 seconds instead of the average since the start, the graph covers the whole transfer and keeps a stall as a dip, and progress moves while the file is being sent on S3, Azure, Dropbox, Box, Google Drive, B2, Swift, Jottacloud, Internxt, OpenDrive, MEGA and Proton.
- SITE commands for FTP and FTPS, from a new Connection menu, sent through the connection already open.
- Resizable Local and Remote panels, and a day and night appearance on a schedule. Drag or use the keyboard on the divider, and the split is kept across restarts. Appearance can follow the system or switch at the times you set.
- AeroAgent 1.7. It can operate the visible app when you ask it to (select, navigate, connect a saved profile, change settings), each step approved, with a cursor on screen and a badge to slow it down, pause or stop it. It also runs the community be
用户点评
登录用户的真实使用记录，可按版本和硬件筛选共 0 条
还没有人点评。第一个说出真实体验的人最有价值。
AeroFTP
Last updated: 2026-10-26
Platform Status
| Platform | Status | Packages | Notes |
|---|---|---|---|
| Linux | Stable | .deb, .rpm, .snap, .AppImage, AUR, Flatpak (FlatPark) | GNOME, KDE Plasma, XFCE, Hyprland, Sway, i3 (X11 & Wayland) |
| Windows | Stable | .msi, .exe, .zip portable, winget | Fully tested, not Microsoft Store signed |
| macOS (Intel & Apple Silicon) | Stable | .dmg (aarch64), .dmg (x64) | Not Apple code-signed, requires xattr workaround |
macOS note: The
.dmgis not yet signed with an Apple Developer ID certificate. macOS Gatekeeper will block it. After installing, run:sudo xattr -rd com.apple.quarantine /Applications/AeroFTP.app
FTP-First Design
AeroFTP is an FTP client first. Full encryption support with configurable TLS modes (Explicit TLS, Explicit TLS if available, and Implicit TLS). A failed explicit upgrade stops the connection. Certificate verification is configurable. Listings use MLSD/MLST when the server offers them (RFC 3659), and transfers can resume with REST/APPE. It then extends this foundation into a broad multi-protocol file management platform through seven integrated product modules - the Aero Family.
Integrations
AeroFTP organizes integrations on three tiers, so what you see in the catalog is precise rather than vague. The figures below are generated into docs/PROVIDER-INVENTORY.json from the catalog and the registry, and CI fails when they drift from the code:
- Transport protocols (8): native wire-level support for FTP, FTPS, SFTP, SCP, WebDAV, S3, Azure Blob, OpenStack Swift. SCP reaches SSH servers without SFTP, including OpenWrt routers; SFTP profiles fall back to SCP on the same connection by default (see SCP support and limits). Plus portable devices over MTP / WPD - attached phones, cameras and media players that the OS never assigns a drive letter, saved as profiles keyed to a stable device fingerprint (see Portable devices).
- Native provider integrations (26): dedicated OAuth2 / API key / SDK code paths per provider, so each one's specific features (sharing, native delta sync, server-side copy, large-file chunking, media-CDN transformations) are first-class instead of best-effort. Includes the dedicated media services tier (ImageKit, Uploadcare, Cloudinary, Immich, PixelUnion).
- Pre-configured presets (49): the form arrives already filled in, server URL, port, base path and password-generation deep-link, for a named service on top of the protocols above (S3-compatible endpoints from MEGA S4 to FileLu S5 to MinIO, WebDAV-compatible servers including Nextcloud, TAB.DIGITAL, Felicloud, Seafile, InfiniCLOUD, etc.). A form with nothing pre-filled is not a preset: the two generic ones (Custom S3, WebDAV Server) exist precisely for when no preset applies.
| Provider | HQ | Free tier | Connection methods |
|---|---|---|---|
| 4shared | VG | 15 GB | OAuth, WebDAV |
| Alibaba OSS | CN | new-user trial, overseas | S3* |
| Amazon Web Services (AWS) | US | 12-month trial | S3* |
| Backblaze B2 | US | 10 GB | API, S3 |
| Blomp | US | 40 GB (+40 GB per referral) | Swift |
| Box | US | 10 GB | OAuth |
| Cloudflare R2 | US | 10 GB (egress-free, card req.) | S3* |
| Cloudinary | US | credit-based | API |
| CloudMe | SE | 3 GB | WebDAV |
| DigitalOcean Spaces | US | paid plan | S3* |
| Drime | FR | 20 GB | API |
| DriveHQ | US | 5 GB | WebDAV |
| Dropbox | US | 2 GB | OAuth |
| Fastly | US | 5 GB (card req.) | S3* |
| Felicloud | EU | 10 GB (Nextcloud host) | WebDAV |
| Filebase | US | 5 GB | S3 |
| FileLu | US | 1 GB | API, FTP, WebDAV, S5 (S3) |
| Filen | DE | 10 GB (E2E) | API, S3, WebDAV |
| GitHub | US | repo storage | API |
| GitLab | US | repo storage | API |
| Google Cloud Storage | US | 5 GB (always-free, card req.) | S3* |
| Google Drive | US | 15 GB | OAuth |
| Hetzner Storage Box | DE | paid plan | SFTP* |
| IBM Cloud Object Storage | US | 12-month trial | S3* |
| IDrive e2 | US | 7-day trial | S3* |
| ImageKit | IN | 20 GB (media CDN) | API |
| Immich | - | self-hosted | API |
| InfiniCloud | JP | 25 GB | WebDAV |
| Internxt | ES | 1 GB (E2E) | API |
| Jianguoyun | CN | 3 GB (monthly traffic cap) | WebDAV |
| Jottacloud | NO | 5 GB | API |
| kDrive | CH | 15 GB | API |
| Koofr | SI | 10 GB | API, WebDAV |
| Mail.ru Cloud | RU | 8 GB (app password required) | WebDAV |
| MEGA | NZ | 20 GB (E2E) | API, MEGAcmd, S4 (S3)* |
| Microsoft Azure Blob | US | 12-month trial | Blob* |
| Microsoft OneDrive | US | 5 GB | OAuth |
| MinIO | - | self-hosted | S3 |
| Nextcloud | - | self-hosted | WebDAV |
| OpenDrive | US | 5 GB | API, WebDAV |
| Oracle Cloud | US | 20 GB (always-free, card req.) | S3* |
| pCloud Drive | CH | 10 GB | OAuth, WebDAV* |
| PixelUnion | EU | 16 GB (managed Immich) | API |
| Proton Drive | CH | 5 GB (E2E) | API / CLI |
| Quotaless | - | trial / invite | S3*, WebDAV* |
| S3Drive | - | 12 GB (via Storj) | S3 |
| Seafile | - | self-hosted | WebDAV |
| SourceForge | US | OSS hosting | SFTP |
| Storj | US | 30-day trial | S3* |
| TAB.DIGITAL | EU | 8 GB (managed Nextcloud) | WebDAV |
| Tencent COS | CN | 6-month trial | S3* |
| Tigris Data | US | 5 GB | S3 |
| Twake Drive | FR | 5 GB | OAuth |
| Uploadcare | US | 1 GB (media CDN) | API |
| Wasabi | US | 30-day trial | S3* |
| Yandex Disk | RU | 5 GB | OAuth, WebDAV* |
| Yandex Object Storage | RU | 1 GB (always-free, card req.) | S3* |
| Zoho WorkDrive | IN | 5 GB | OAuth |
58 providers, 72 connection methods. * marks a paid / credit-card-gated plan. HQ is the ISO 3166-1 alpha-2 of the company HQ (EU = pan-European). Free-tier sizes are approximate: verify with the provider.
See the protocol features matrix for full per-provider capabilities.
Profile Bridge
AeroFTP bridges server profiles with 15 third-party tools, bidirectionally (import and export), from a unified interface in the GUI (Settings > Export/Import > Bridge) and the CLI (aeroftp import <tool> / aeroftp export <tool>). Recovered credentials are upgraded into the AES-256-GCM encrypted vault on import and re-encoded into each tool's native format on export. Duplicate detection shows which servers already exist, with the option to update credentials on re-import.
File-transfer & SSH clients
| Tool | Config / file | Protocols | Credentials |
|---|---|---|---|
| rclone | rclone.conf (INI) | 24 backend types, plus crypt and alias remotes | Full (AES-256-CTR, published key) |
| WinSCP | WinSCP.ini (INI) | SFTP, SCP, FTP, FTPS, WebDAV, S3 | Full (XOR obfuscation) |
| FileZilla | sitemanager.xml (XML) | FTP, FTPS, SFTP, S3 | Full (Base64) |
| lftp | rc / bookmarks | FTP, FTPS, SFTP, WebDAV | Limited |
| Cyberduck | .duck bookmark (plist/XML) | FTP, FTPS, SFTP, WebDAV, S3 | Metadata only (keychain) |
| MobaXterm | MobaXterm.ini | FTP, FTPS, SFTP, WebDAV, S3 | Limited (host-bound) |
| PuTTY | registry .reg export | SFTP | Metadata only |
| OpenSSH | ssh config | SFTP | Metadata only (key / agent) |
| Dreamweaver | .ste site export (XML) | FTP, FTPS, SFTP, WebDAV, S3 | Full |
S3 / object-storage tools
| Tool | Config / file | Protocols | Credentials |
|---|---|---|---|
| AWS CLI | credentials / config (INI) | S3 | Full |
| MinIO Client (mc) | config.json (JSON) | S3 | Full |
| s3cmd | .s3cfg (INI) | S3, SFTP, WebDAV | Full |
Backup tools
| Tool | Config / file | Protocols | Credentials |
|---|---|---|---|
| Kopia | repository.config (JSON) | S3, SFTP, WebDAV | Full |
| restic | env script (RESTIC_REPOSITORY + AWS env) | S3, SFTP, WebDAV | Full |
| Duplicacy | preferences (JSON) | S3, SFTP, WebDAV | Limited |
Credentials: Full = the secret is recovered and upgraded into the vault; Limited = only part of the secret material (host-bound or optional); Metadata only = connection metadata is imported but the secret stays in the OS keychain / SSH agent / an interactive prompt. The three original tools keep dedicated bridge pages: rclone, WinSCP, FileZilla.
Full compatibility matrix: for the per-protocol and per-provider breakdown of every bridge (including which native cloud providers travel only through rclone), see the Bridge compatibility matrix.
rclone crypt interop (full read/write): in addition to profile import/export, AeroFTP can browse, decrypt and re-encrypt existing
rclone cryptremotes natively. Upload, download, rename, and delete all stream through a transparent crypto overlay session: the underlying provider sees only encrypted blobs and obfuscated filenames, while the UI shows plaintext paths. See the rclone crypt page.
rclone filter conversion:
aeroftp-cli import rclone-filter <path>converts an rclone--filter-fromfile (with+/-rules and#comments) into an.aeroignorefile. Rule order is reversed automatically to preserve rclone's first-match-wins semantics under gitignore last-match-wins. Brace alternation{a,b}and!reset directives are reported as warnings since they have no direct gitignore equivalent.
Hosting Provider Integration
Web hosting providers can generate encrypted .aeroftp connection profiles from their control panels, so customers can import pre-configured FTP/SFTP connections with a single click - no manual setup, no credentials in plaintext emails.
See the Hosting Integration Guide for the file format specification, encryption details, and ready-to-use code examples in Python and Node.js.
File Formats
AeroFTP defines eight user-facing file formats. Each has a single purpose and a distinct extension; desktop file associations for .aerozip, .aerovault, .aeroftp-script, .aeroftp and .aeroftp-keystore are registered on Windows, macOS, and Linux, with .aerozip shipping CLI create/list/extract first. They are ordered from simplest to most advanced: compression, then encryption, then error correction, then the profile / script / keystore family.
| Extension | Purpose | Encryption | Carries |
|---|---|---|---|
.aerozip | Plaintext recoverable archive (aeroftp-cli archive create/list/extract) | None - integrity + Reed-Solomon recovery, not confidentiality | Arbitrary files and folders inside a compressed, self-healing archive readable by anyone with the file |
.aerovault | Encrypted container (alternative to Cryptomator / .zip / .rar) | AES-256-GCM-SIV + Argon2id | Arbitrary files and folders inside a single sealed archive |
.aerocorrect | Detached Reed-Solomon recovery sidecar (magic AEROCORR, format v2), par2-style; shared by AeroVault and AeroSync. The protected file stays byte-identical | None - integrity + recovery, not confidentiality | Content-SHA-bound reconstruction parity for a sibling file or vault; selectable overhead (~7% / ~15% / ~25% / ~30%) |
.aeroignore | Ignore-pattern file (gitignore-style, last-match-wins) for AeroSync and transfers; convert from rclone filters with aeroftp-cli import rclone-filter | None (no secrets) | Exclude / include glob rules; references no credentials |
.aerosync | Shareable AeroSync template: direction, mode, exclusions, verify policy and Plan settings, exported and imported from the AeroSync dialog | None (no secrets) | Sync settings only; paths and saved-profile names, never credentials |
.aeroftp-script | Portable batch script for aeroftp-cli batch (safer alternative to .sh / .ps1, runs on every OS where AeroFTP is supported) | None (no secrets) | AeroFTP CLI command lines; references saved profiles by name, never inline credentials |
.aeroftp | Server-profile export and cross-tool exchange format (bridge with rclone / WinSCP / FileZilla) | AES-256-GCM + Argon2id | Selected saved profiles (host, user, protocol, paths). With include credentials on, also per-profile passwords and per-profile OAuth / Jottacloud tokens |
.aeroftp-keystore | Full vault backup | AES-256-GCM + Argon2id | Everything in the vault: every profile, every credential, AI provider keys, app settings, theme and background preferences, AI chats |
.aerovault, .aeroftp and .aeroftp-keystore are encrypted with a user-chosen password at seal / export time. .aerozip is plaintext on purpose: it provides integrity and recovery (Reed-Solomon parity is on by default and opt-out, --recovery-level 0 for a smaller parity-free archive), not secrecy, and .aerocorrect is the detached form of that same recovery parity, carrying no secrets. .aeroignore, .aerosync and .aeroftp-script are also plaintext on purpose: they never carry secrets, so they can be checked into a repository, scheduled by cron / Task Scheduler, or shared with a teammate without any vault round-trip.
The Aero Family
AeroFTP
├── AeroCloud - Personal cloud (supported server and cloud profiles, sync, share)
├── AeroFile - Professional file manager (multi-file Properties, recursive search, default-app routing)
├── AeroShare - Peer-to-peer user-to-user transfer (end-to-end encrypted, no server in the middle) [Beta]
├── AeroMount - Persistent FUSE / WebDAV mounts with cross-platform autostart (the Mount Manager)
├── AeroSync - Bidirectional sync engine
│ └── AeroRsync - Native Rust delta sync (clean-room rsync protocol 31)
├── AeroVault - Military-grade encryption
├── AeroTools - Code editor + Terminal + AI chat
│ └── AeroAgent - AI-powered assistant (86 built-in tools, 26 providers)
├── AeroFTP CLI - Production command-line client (vault profiles, JSON output, batch scripting, daemon, FUSE mount, crypt, ncdu, agent discovery)
└── AeroPlayer - Media player with visualizers
AeroCloud - Your Personal Cloud
Turn a supported server or cloud account into a private personal cloud. Choose from the profiles offered in AeroCloud setup for bidirectional sync, selective sync, file versioning, .aeroignore, share links, and per-project folders. SCP connections are available in AeroFTP but are not yet offered by AeroCloud setup. Background tray sync includes native OS file manager badges (Nautilus, Nemo, Windows Explorer). See the protocol features matrix for full per-provider capabilities.
AeroFile - Professional File Manager
A full-featured local file manager built into AeroFTP. Toggle between remote and local modes, or use both side-by-side. Three view modes (list, grid, large icons), Places sidebar with drives and network shares, Quick Look preview (Space), drag-and-drop transfers, batch rename, duplicate finder, disk usage treemap, trash browser, properties dialog with checksums, and 20+ keyboard shortcuts.
v3.7.1 polish: aggregate multi-file Properties dialog (Windows-style mixed-state indicators across the selection), recursive * flatten search that lists every descendant under the current directory in one shot, smart "Open with default app" routing in the right-click menu (vault containers open in AeroFTP, scripts drop into the AeroTools Terminal with the right shell prefix, anything else goes through the OS), and a PathBar with empty-area edit mode plus a trailing chevron dropdown over first-generation subdirectories.
Dual panel (v3.7.9, Slice A): two local panels side by side in AeroFile mode, toggled via the Columns icon in the toolbar or Ctrl+Shift+D. Full keyboard parity on the second panel (F2 / Delete / Enter / Backspace / clipboard / Quick Look / properties / arrows / Shift+arrow / Home / End all route to the focused pane; Tab cycles between local and local2). Total-Commander shortcuts: F5 copies the selection to the other panel, F6 moves it, F7 creates a folder in the focused panel. Drag-and-drop between the two panes uses the existing rename_local_file / copy_local_file backend; Ctrl+drag switches from move (default) to copy. The separator is resizable from mouse and from keyboard (Arrow Left/Right ±10%, Home/End to extremes, Enter/Space to reset to 50/50). Unified tab strip with L / R markers and per-panel persistence. Slice B (each pane configurable as a local path or as a saved remote profile) and Slice C (FreeFileSync-style compare / mirror / backup / bisync workflows on top) follow in their own release windows. Tracked in issue #162 section 2.
AeroMount - the Mount Manager
AeroMount is the Mount Manager of AeroFTP, reachable from File > AeroMount, the My Servers toolbar, and the connected remote address bar. Save multiple FUSE / WebDAV mount configs (profile, remote path, mountpoint, read-only, cache TTL, allow-other, auto-start) in either a plaintext sidecar JSON (default, daemon-friendly) or in the encrypted vault, toggleable from the dialog header. Per-row Mount / Unmount / Open in file manager / Edit / Delete actions, with a "Pick free drive letter" helper on Windows.
- Cross-platform autostart: installs
~/.config/systemd/user/aeroftp-mount-<id>.serviceunits on Linux (Type=simple, Restart=on-failure) and Task Scheduler ONLOGON entries on Windows. Master-password vault mode blocks autostart with a clear UI explanation since the daemon cannot prompt for a password. - Open mount in file manager: a one-click action on the My Servers context menu that auto-creates a sensible default mount for the selected profile when none exists yet, waits 800 ms for the FUSE / WebDAV layer to settle, then opens the OS file manager at the mountpoint.
- No secrets in mount configs: credentials are always resolved by the spawned
aeroftp-clithrough--profileagainst the same vault the GUI uses, mount configs only carry the profile id. - Read-only vault mount + Save-All (v4.0.9, Linux first): mount an unlocked Cryptomator vault,
.aerovaultor.aerozipas a read-only filesystem to browse its decrypted contents in your OS file manager, or run Save-All to export the whole decrypted tree in one shot to a folder, a.zipor a.aerozip. The password is passed to the mount process over stdin and never stored, and the mount auto-unmounts when you lock the vault or quit. macOS and Windows are a later step.
AeroSync - Bidirectional Sync Engine
Enterprise-grade file synchronization built for real-world reliability. Three sync profiles (Mirror, Two-way, Backup), conflict resolution center with per-file strategies, SHA-256 checksum verification, transfer journal with checkpoint/resume, configurable retry with exponential backoff, bandwidth control, post-transfer verification (4 policies), and structured error taxonomy with 10 categories. Integrates with AeroCloud for background tray sync.
AeroShare - Peer-to-Peer Transfer (Beta)
Send a file or a folder straight to another person, end-to-end encrypted, with no server in the middle. AeroShare opens a direct peer-to-peer channel between the two devices (built on iroh 1.0 with Mainline-DHT discovery and federated relays as fallback), so the bytes never pass through a hosted account. Always-on at launch: a Discover tile with a 256-bit E2E badge, a +friend button in the titlebar, a draggable hub dialog and a status-bar receiver indicator. Add a friend or share a folder and the feature auto-activates; the standing receive loop is opt-in (a one-time prompt, changeable from Settings) so you decide when your device accepts incoming transfers. Each sender gets their own Inbox and an address book remembers the people you exchange with.
This is a Beta preview shipping in v4.1.0. The transport is hardened (iroh 1.0 cleared the prior dependency advisories) and decentralized by design, with more of the surface and notifications still being refined.
AeroRsync - Native Rust Delta Sync
Independent clean-room Rust implementation of the rsync wire protocol 31. AeroRsync speaks bytes-on-wire to a standard remote rsync --server, so AeroFTP does byte-level delta sync without an rsync binary on the client - no rsync.exe bundle, no MSYS2, no WSL. That is the whole reason it exists: on Unix rsync is already everywhere, on Windows it is not, and bundling a GPL binary or demanding WSL would have split the product into a first-class Unix and a second-class Windows.
It does not replace rsync. It talks to it.
Where it runs. The Cargo feature aerorsync is compiled by default, and the runtime toggle (Settings → Advanced) has been ON by default in Auto mode since v3.8.0. On Unix Auto attempts the native engine first and keeps the classic rsync binary as a fallback; on Windows the native engine is the only delta path. Soft conditions (file below min_file_size, no key on disk, no remote rsync) route back to a plain upload; security failures (host-key mismatch, permission denied) are hard errors and never silently downgrade.
Where it is wired. AeroSync delta transfers, Cross-Profile SFTP-to-SFTP, and AeroTools Code Editor saves against a remote file - a one-line change to a 5 MB file ships only the differing blocks. AerorsyncBatch reuses one SSH session for N files in a sync batch, and SyncReport surfaces delta_files and bytes_on_wire so the UI shows which files took the optimized path and what it saved.
Compression on the wire. rsync negotiates which compressor carries the literal data, and the winner is the first name in your own advertised list that the peer also offers. That makes the list a promise, not a wish: AeroRsync advertises zstd zlibx none and drives all three, rather than mirroring stock rsync's zstd lz4 zlibx zlib none and hoping. Every rsync built before 3.2.0 has no zstd at all, which covers NAS firmware, embedded boxes and older LTS images, and those peers land on zlibx: raw deflate on one session-wide stream with a Z_SYNC_FLUSH boundary per record, pinned against a captured rsync 3.1.3 wire oracle that runs in CI alongside the 3.2.7 lane. Plain zlib is declined on purpose and structurally: it also feeds matched-block data through the compressor history on both ends, so decoding it needs inflateIncomp, a function rsync patches into the zlib it bundles and which exists in neither the system zlib nor any Rust crate. That is precisely why upstream split zlibx out. Listing none last means the two lists always intersect, so a peer offering only codecs we decline still gets a working delta transfer, just an uncompressed one, instead of dropping off the native path entirely.
Measured against stock rsync
Same 50 MB files, same container, same SSH loopback, back-to-back on an idle 24-core machine. This historical run used -logDtprcz, producing the same server arguments as the AeroRsync capture profile at that time (-logDtprcze.iLsfxCIvu). The current product profile uses -ltprcz (plus A/X when enabled); these timings have not been remeasured with the current flags.
| Scenario | AeroRsync | stock rsync 3.2.7 |
|---|---|---|
| Cold upload, 50 MB incompressible | 1.07 s | 1.37 s |
| Delta upload, 640 × 4 KiB changed | 2.00 s | 1.36 s |
| Delta download, same change set | 1.31 s | 1.34 s |
| Redundant upload (nothing to do) | 0.46 s | 1.26 s |
| 20 × 256 KiB, one session per file | 4.98 s | 25.25 s |
20 × 256 KiB, one recursive rsync call | (no recursive scope) | 1.31 s |
Read honestly, that is three different results. AeroRsync wins where a process would have to be spawned - a cold upload, a no-op, and twenty small files one at a time, where rsync pays a fresh ssh plus rsync fork per file and AeroRsync opens an in-process session. It loses the delta upload by ~30% while putting the same work on the wire: 3,748,322 bytes against rsync's 3,743,589, a 0.13% difference, so the gap is CPU in the encode path and not the protocol. And rsync still does the whole 20-file tree in one invocation in 1.31 s, which is 3.8× better than AeroRsync's per-file path - that is the recursive-scope gap, and AerorsyncBatch is what closes it at the transport layer.
Repeated across three runs the timings move by a few percent and the byte counts do not move at all. Detailed methodology, dataset characterisation and the full parity matrix: docs/PROTOCOL-RSYNC-COMPARE.md.
What is verified
- 677 unit tests on the module, pinned against frozen rsync 3.2.7 byte transcripts.
- 15 live tests in CI lane 3 against a real
rsync --serverin Docker: a byte-identical upload (sha256 match), streaming upload, symlinks both directions,user.*xattrs inline, out-of-band, binary-with-NUL and empty, the batch path over a single session, a symlink proving it does not inherit its target's attributes, POSIX access ACLs in both directions, and an unsupported compressor or checksum routing to the classic fallback. - 8 live tests across the negotiated checksum matrix - xxh128, xxh3, xxh64, md5, md4, sha1 - driving the production upload and download transports.
Known limits
Single file per invocation: AeroRsync is a delta accelerator, not a tree walker - enumeration, deletion and retention stay with AeroSync, which owns its own safety gates. Protocol 31 only, SSH remote-shell only: no rsync:// daemon mode, and an endpoint negotiating protocol 27-30 falls back to a plain SFTP transfer without delta in Auto/Native mode. Unix users can explicitly choose Classic mode to use the installed stock rsync binary. Metadata preserved today is mtime, permissions, symlinks (Unix), user.* xattrs (Unix, -X) and POSIX.1e access ACLs (Linux only, opt-in, -A); owner/group and device files are not implemented, and hardlinks are structurally blocked until recursive scope exists, because detecting that two paths share an inode needs the whole file list.
One version note worth stating plainly: upstream rsync dropped sha1 from the negotiated checksum list between 3.2.7 and 3.4.1. AeroRsync still implements it, and it works against peers that still offer it, but against a modern rsync it is simply not negotiable.
Shaped Graph Transfer (DAG)
Since v4.0.0, AeroFTP has a shared, provider-agnostic DAG core and production runners for selected transfer paths. The graph is not a promise that every surface uses every shape: the active call path, the provider binding, and the wire-level behavior are separate facts.
- Single-file get/put normally use the shaped-file runner; plain WebDAV and Nextcloud downloads take the provider-direct path, and
--transfer-engine dag|legacy(orAEROFTP_TRANSFER_ENGINE) forces one engine for plain single-file transfers (completed SFTP delta transfers, resumed downloads and the desktop app's segmented downloads take their own paths). MultipartUploadPartnodes and the begin/part/complete/abort lifecycle are real; independent wire-level fan-out is currently available only where the provider supplies an independent transfer worker (S3, Backblaze B2, Azure Blob, Nextcloud chunked v2, Dropbox, Box, Filen, Drime and Uploadcare). Other providers may build multipart nodes but serialize provider calls through their shared session. - Batch and non-dry-run sync stream their file list through a bounded frontier of per-file subgraphs instead of one static graph. Providers with a clone or session pool (S3, Backblaze B2, Azure Blob, WebDAV, SFTP, FTP, Dropbox, Box, Filen, Drime and Uploadcare) run files in parallel up to their live session ceiling; single-session providers, a failed clone probe and every delta request stay serial.
- Server-side copy is a production
shaped_copygraph: the GUI copy, CLIcpand the CLI WebDAVCOPYhandler build oneServerSideCopynode, or an observable download then upload when the provider rejects the native copy with a recoverable error. A native copy moves no payload through the client, and no DAGUploadPartCopyclaim is made. - Segmented downloads run on the
shaped_rangesgraph, the only production range scheduler. Files at or above the 250 MiB cutoff use several range streams by default: 4 in the CLI (--multi-thread-streams), and in the desktop app 8 on SFTP, WebDAV, FTP and FTPS and 4 on S3. Smaller files, and providers whose range support is not proven or not yet measured, use one stream.
The GUI, CLI, and MCP adapters therefore share engine primitives where their call paths reach them, but wire behavior is provider- and operation-dependent: cross-profile copy still runs through its own temp-file bridge rather than one shared graph, and capabilities and runtime knobs are meaningful only on the command path that consumes them.
AeroVault - Military-Grade Encryption
Create, manage, and browse encrypted containers that protect your files with a security stack that exceeds industry standards. The encryption engine is published as the standalone aerovault crate (crates.io · docs.rs) for use in any Rust project.
AeroVault v2 (.aerovault containers)
| Component | Algorithm | Details |
|---|---|---|
| Content encryption | AES-256-GCM-SIV (RFC 8452) | Nonce misuse-resistant - even nonce reuse doesn't compromise security |
| Key wrapping | AES-256-KW (RFC 3394) | Built-in integrity check on unwrap |
| Filename encryption | AES-256-SIV | Deterministic - file names are hidden, not just content |
| Key derivation | Argon2id | 128 MiB memory / 4 iterations / 4 parallelism (exceeds OWASP 2024) |
| Header integrity | HMAC-SHA512 | 512-bit MAC, quantum-resistance margin |
| Cascade mode | ChaCha20-Poly1305 | Optional double encryption layer for defense-in-depth |
| Chunk size | 64 KB | Per-chunk random nonce + authentication tag |
Open format: The
.aerovaultbinary format is fully documented in the AeroVault v2 Specification with implementation guides for Rust, Java, Python, Go, C, and JavaScript.
AeroVault v3 (content-addressed, Archive tier)
A content-addressed, deduplicating container that ships alongside v2 and is selectable as the Archive security level in the create dialog. v2 remains the default in the GUI and there is no automatic v2 → v3 migration; the full lifecycle is scriptable from the CLI for every format (aeroftp-cli vault create/add/info/extract, --vault-version v1|v2|v3 with header auto-detect, --cascade for the v2 paranoid mode, --receipt for the technical telemetry). The reader/writer is shared with the standalone aerovault crate (crates.io).
| Component | Algorithm | Details |
|---|---|---|
| Chunking | Gear-CDC (content-defined) | Variable-size boundaries; same plaintext bytes always produce the same chunk so dedup is stable across edits |
| Compression | zstd, per chunk | Three profiles: fast (-3), balanced (-9), archive (-19) |
| Content encryption | AES-256-GCM-SIV (RFC 8452) | 96-bit random nonce per chunk + per-chunk AAD bound to block index and chunk id |
| Chunk addressing | BLAKE3 keyed, 128-bit | Content-addressed chunk id, also the dedup key |
| Cipher integrity | BLAKE3-256 | Pre-decryption check on cipher blocks; load-bearing for the v4 Error Correction layer |
| Key derivation | Argon2id | 128 MiB / t=4 / p=4, identical to v2; derives two independent KEKs via HKDF (encryption + MAC) |
| Key wrapping | AES-256-KW (RFC 3394) | Two independent random 256-bit working keys, one per KEK |
| Header integrity | HMAC-SHA512 | 1024-byte header, MAC verified before any key unwrap |
| Extension area | Reserved | Extension directory + payload region used by the v4 Error Correction layer; v3 readers skip non-critical unknown entries, reject critical unknown entries |
The wire layout, the wrapper IDs, and the forward-compat contract (v3 + Error Correction = v4, the v3 vault is byte-equivalent to "v4 with Error Correction turned off") are pinned in the AeroVault v3 Specification. Tracked in issue #162 section 4 / T-AEROVAULT-ECC.
AeroVault v4 (v3 + Error Correction)
v4 is not a new container format, it is v3 plus a Reed-Solomon Error Correction layer, so a v3 reader still opens a v4 vault (it ignores the parity). Recovery data can be embedded in the container, kept in a detached sibling sidecar that leaves the encrypted container byte-identical, or both.
| Component | Algorithm | Details |
|---|---|---|
| Recovery codec | Reed-Solomon (fixed grid) | Per-shard 16-byte truncated BLAKE3 localizes rot so only damaged shards are erased and rebuilt; a bad parity shard is detected and routed around |
| Detached sidecar | .aerocorrect (magic AEROCORR, format v2) | One unified, content-SHA-bound recovery format shared by the vault and AeroSync; protects any byte stream, par2-style |
| Self-healing | Triplicated locator + per-copy checksums | A lightly-corrupted sidecar still recovers; the bulk parity has no wholesale checksum because each shard self-checks |
| Overhead levels | Low ~7% / Medium ~15% / Quartile ~25% / High ~30% (or 5-50%) | Selectable target; the exact grid is stored in the payload so reconstruction is level-agnostic |
| Repair contract | Fail-closed, all-or-nothing | Rebuilt bytes are re-verified against the authenticated header MAC / manifest cipher_hash before the vault is persisted, so a foreign or corrupt sidecar can only make repair fail, never overwrite good data |
Exposed in the AeroVault GUI (create with Error Correction, scrub, repair) and the CLI (vault create --error-correction, vault scrub, vault repair, export-parity, strip-parity; the standalone correct gen/verify/repair; sync --error-correction). The .aerocorrect format is documented in AeroVault v3 Specification section 11 and is byte-identical with the standalone aerovault crate.
Additional encryption features:
- Overlay session model (v3.7.0): open an
.aerovaultonce, then route every list/upload/download/rename through the encrypted overlay transparently. The provider sees only opaque vault chunks; the UI shows plaintext entries and folders. A status badge in the header marks when the overlay is active. - Directory support: Create nested folders inside vaults with encrypted directory entries, hierarchical navigation, and recursive delete
- Cryptomator: Create and browse Cryptomator format 8 vaults (scrypt + AES-SIV + AES-GCM) via context menu
- Archive Browser: Browse ZIP, 7z, TAR, RAR contents in-app without extracting. Selective single-file extraction
- Archive Encryption: ZIP and 7z with AES-256 password protection. Compression levels (Store/Fast/Normal/Maximum)
AeroTools - Security Tools, Code Editor, Terminal & AI Chat
Four independent launchers open Security Tools (Hash Forge, CryptoLab and Password Forge), Monaco Editor (VS Code engine, 50+ languages, remote file editing), Terminal (local PTY and SSH sessions, 13 themes, multiple tabs), and AeroAgent AI Chat with bidirectional editor sync.
AeroAgent - AI-Powered Assistant
An AI assistant with 86 built-in tools that work across local files and remote providers. Supports 26 AI providers (OpenAI, Anthropic, Gemini, xAI, Ollama, DeepSeek, Mistral, Cerebras, SambaNova, Fireworks, Nvidia, and 15 more). Vision/multimodal, RAG indexing, plugin ecosystem, streaming responses, multi-step autonomous execution, native MCP server mode (78 MCP tool names), and Command Palette (Ctrl+Shift+P).
Agent-Ready by Design
AeroFTP is built for both humans and AI agents. As agentic AI, computer use, and autonomous coding assistants become the standard way to interact with computers, AeroFTP provides native interfaces for both use cases.
For AI Agents (CLI): Tools like Claude Code, Open Interpreter, Cline, Aider, Devin, Codex, Cursor Agent, Windsurf, and other agentic frameworks can call aeroftp-cli directly. Structured --json output, vault-based --profile credentials (agents never see passwords), semantic exit codes, and .aeroftp-script batch files make AeroFTP a first-class tool in any agent's toolkit. External agents can also invoke aeroftp-cli agent to orchestrate AeroAgent as a credential-isolating proxy for multi-server operations. See Agent Orchestration for the full orchestration guide, CLI reference, and a verified field test report.
For Humans (GUI + AeroAgent): The desktop app provides drag-and-drop file management with AeroAgent, the integrated AI assistant offering 86 built-in tools across local files and remote providers. AeroAgent supports multi-step autonomous execution, tool approval workflows with backend-enforced grants, and 26 AI providers.
AeroFTP CLI - Command-Line Client
Production CLI sharing the same Rust backend as the GUI. 99 top-level commands (several grouping their own subcommands: daemon, jobs, vault, archive, crypt, import/export, serve, users, groups) across 8 transport protocols and 26 native provider integrations, encrypted vault profiles, JSON output, batch scripting, daemon mode with job queue, FUSE filesystem mounting, ncdu TUI explorer, zero-knowledge crypt overlay, single-file AeroVault containers (vault, all formats v1/v2/v3), plaintext .aerozip archives (archive create/list/extract), recursive used-storage scan (df --scan) with a manual total-cap override, and native MCP server mode for AI integration.
Short invocation: every package ships a native dispatcher, so
aeroftp <subcommand>and the built-in 4-character nameaftpboth route to the CLI;aeroftp-cliis kept for back-compat. An opt-inaeroalias can be enabled withaeroftp-cli alias-toggle aero(idempotent, the same command turns it off). See the Short Invocation section of the CLI Guide.
aeroftp-cli ls --profile "My Server" /var/www/ -l # Vault profile (no credentials exposed)
aeroftp-cli get sftp://user@host "/data/*.csv" # Glob download
aeroftp-cli check --profile "My Server" /local /remote # Compare tree sizes; see CLI guide for checksum limits
aeroftp-cli archive create backup.aerozip ./docs # Plaintext archive: recovery, not secrecy
aeroftp-cli sync --profile "My Server" /local /remote --watch # Continuous bidirectional sync
aeroftp-cli serve http sftp://user@host /data # Serve remote as local HTTP
aeroftp-cli serve webdav s3://key:[email protected] # Serve remote as local WebDAV
aeroftp-cli agent --mcp # MCP server for Claude/Cursor/VS Code
aeroftp-cli mount /mnt/remote sftp://user@host # FUSE filesystem
aeroftp-cli ncdu sftp://user@host /data # Interactive disk usage
aeroftp-cli daemon start # Background job queue
Key features: --profile credential isolation for AI agents, --json structured output, semantic exit codes (0-11), .aeroftp-script batch files, archive create/list/extract for plaintext .aerozip recovery archives, check / cryptcheck for local-vs-remote verification (size/checksum against cleartext or encrypted remotes), dedupe / cleanup for orphan management, hashsum for remote file hashing (sha256/md5/blake3), link for shareable URLs, --bwlimit "08:00,512k 18:00,off" time-based bandwidth schedule (local time), serve http/webdav/ftp/sftp, MCP server mode, --immutable append
Files
files-community·C#
一款面向 Windows 的现代文件管理器，用多标签页、双栏浏览和 Fluent 设计改进资源管理器的使用体验，方便整理文件和文件夹。
文件管理器+4文件管理
46571+573.0kv4.32026-11-10 00:37 UTC
yazi
sxyazi·Rust
用 Rust 写的终端文件管理器，基于异步 I/O 实现极快的目录浏览和文件操作，适合习惯命令行的开发者日常管理文件。
终端文件管理器+4文件管理
43329+581.1kv26.9.12026-11-10 07:28 UTC
spacedrive
spacedriveapp·Rust
用 Rust 写的跨平台开源文件管理器，底层是虚拟分布式文件系统，能把多台设备上的文件统一管理，像访问本地一样浏览和整理。
文件管理器+4文件管理
39476+271.4k0.4.32026-11-06 11:49 UTC
filebrowser
filebrowser·Go
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview and edit your files.
文件管理
358704.2k2026-07-31 10:06 UTC