Your files. Your servers.
One interface.
VoxCloud connects Google Drive, OneDrive, FTP, SFTP, and your locally hosted filesystem into one slick, secure self-hosted interface. Grid or list views, drag-and-drop uploads, cross-provider transfers, and a built-in text editor — all with zero external cloud dependencies.
Packed with features.
Built for power users.
Every feature designed from the ground up for security, performance, and a slick experience across multiple data sources.
Full File Manager
Grid/list views, drag-and-drop upload, breadcrumb nav, rename, delete, copy, move — all with keyboard shortcuts. Zero page reloads.
Cross-Provider Transfers
Move or copy files between any two connected providers —
including different accounts. Temp-file pipeline with
finally cleanup.
Public File Sharing
Generate cryptographically random 64-char share links with configurable expiry (1h–30d). 410 Gone on expiry, download count tracked.
In-Browser Text Editor
Live line numbers, Ctrl+S save, unsaved-change guard, language selector, status bar. Works across all providers including FTP/SFTP.
Global Search
400ms debounce, search all providers simultaneously, type filters, highlighted matches, group by provider, navigate directly to file.
Bulk ZIP Download
Select multiple files and folders, stream a ZIP archive with
preserved folder structure. Content-Length set so
browsers show real progress.
User Profiles
Gravatar + custom avatar, real-time password strength meter, active shares table, recent activity — no re-login after profile update.
Admin Dashboard
Live stat cards, async load, provider status panel, login activity, quick actions. System-wide totals for admins.
User Management
Full CRUD via AJAX — create, enable/disable, role toggle, delete. Cascade delete removes all credentials and shares.
Defense in depth.
Every layer secured.
From Argon2ID password hashing to AES-256-GCM credential encryption — every security decision is intentional and documented.
Argon2ID Passwords
PHP password_hash(PASSWORD_ARGON2ID). Silently
re-hashes on login if cost params increase.
AES-256-GCM Credentials
OAuth tokens, FTP passwords, and SFTP keys encrypted before storage. 12-byte random IV per write.
Authenticated EncryptionCSRF Protection
64-char bin2hex(random_bytes(32)) token.
hash_equals() constant-time comparison on all
forms.
PDO Prepared Statements
100% parameterised queries.
ATTR_EMULATE_PREPARES = false. No string
interpolation anywhere.
XSS Prevention
htmlspecialchars($val, ENT_QUOTES, 'UTF-8') on
every output. Covers DB values, GET/POST params, and all
filenames.
Path Traversal Prevention
realpath() resolution +
str_starts_with() root check on every
LocalProvider path. Null bytes stripped.
Session Hardening
HttpOnly, Secure, SameSite=Strict cookies. Session ID rotated on every login and every 30 minutes during active use.
Session Fixation ProofHTTP Security Headers
X-Content-Type-Options: nosniff,
X-Frame-Options: SAMEORIGIN,
Referrer-Policy, Permissions-Policy.
Up and running
in minutes.
No CLI required. Upload files, visit /install/,
follow 4 steps. Works on shared hosting or VPS. Installer
self-locks after completion.
public_html or subdirectory.
.env created on install.
APP_SECRET and ENCRYPTION_KEY.
install/.installed flag.
.htaccess blocks all re-runs. Optionally
delete /install/ entirely.
Your files. Your server.
Your control.
Self-hosted on Apache or Nginx. No subscriptions, no vendor lock-in, no cloud middleman. Deploy on any shared host, VPS, or bare metal.