Security and privacy · Edition No. 32 · 26 Sep 2026

Forceu/Gokapi

A self-hosted page for sending files, where each link expires after a set number of downloads or days and only the owner can upload.

← Security and privacyRead the whole edition →
02

Forceu/Gokapi

💎 hidden gem

2,860 stars · AGPL-3.0, read from the repository page; the LICENSE file returned HTTP 404 on every path tried from this sandbox · v2.2.4 (2026-03-10) · Track this in Scout

A self-hosted page for sending files, where each link expires after a set number of downloads or days and only the owner can upload.

▶Repo detailsthe review · specs · pros & cons · install

What it is

Gokapi is a self-hosted replacement for the old Firefox Send service (self-hosted means the software runs on a machine you control rather than somebody else's). It can keep the files on local disk or push them to S3-compatible storage.

What it is good for. Anyone who regularly sends video, design files, archives or client deliverables and does not want them to live forever in a chat history. The expiry is the point: a link that dies after three downloads or seven days is a link you do not have to remember to clean up. It is also useful for sending something to a person who must not be given an account.

Stars2,860
LicenceAGPL-3.0, read from the repository page; the LICENSE file returned HTTP 404 on every path tried from this sandbox
Latestv2.2.4 (2026-03-10)
Good
  • Upload is private and download is public. Only the account holder can put files in, which is the difference between a sharing tool and an open dumping ground.
  • Every file gets an expiry — a date, a download count, or both — and an optional password.
  • One small Go program, a few tens of megabytes of memory, and a container image if that is easier. Files can go to S3-compatible storage instead of local disk.
Watch for
  • AGPL-3.0. If you modify it and offer the modified version to other people over a network, you have to publish your changes. For private use this costs nothing; for a product built on top of it, read the licence first.
  • It needs HTTPS and a domain name to be useful, which means a reverse proxy or a tunnel in front of it. That is the same prerequisite as entry #1.
  • End-to-end encryption is available but is not the default, and turning it on changes how downloads work. Read the documentation before assuming files are hidden from the machine itself.
Similar repositories
Install
docker run -d --name gokapi \
  -p 53842:53842 \
  -v gokapi-data:/app/data \
  -v gokapi-config:/app/config \
  --restart unless-stopped \
  f0rc3/gokapi:latest
Screenshots
Forceu/Gokapi: GitHub preview cardForceu/Gokapi: Screenshot 1Forceu/Gokapi: Screenshot 2Forceu/Gokapi: Screenshot 3Forceu/Gokapi: Screenshot 4

Get the next edition in your inbox

A dozen repositories, opened and checked. The licence read, the last release dated, and the ones that did not make it named with the reason. It is the half most lists leave out.

No tracking pixels. One click to leave. The archive stays free either way.

We use your address to send the edition and nothing else. Confirm by email, leave in one click. How we handle it.