FTP-First. Multi-Protocol. AI-Powered. Encrypted. Privacy-Enhanced.
The modern FTP client that grew into a complete file management platform. Multi-protocol, 6 integrated product modules, 47 languages, one app.
Website · Documentation · Download
AeroFTP is an FTP client first. Full encryption support with configurable TLS modes (Explicit AUTH TLS, Implicit TLS, opportunistic TLS), certificate verification control, MLSD/MLST machine-readable listings (RFC 3659), and resume transfers (REST/APPE). It then extends this foundation into a broad multi-protocol file management platform through six integrated product modules - the Aero Family.
AeroFTP
├── AeroCloud - Personal cloud (25 protocols, sync, share)
├── AeroFile - Professional file manager
├── AeroSync - Bidirectional sync engine
├── AeroVault - Military-grade encryption
├── AeroTools - Code editor + Terminal + AI chat
│ └── AeroAgent - AI-powered assistant (47 tools, 19 providers)
├── AeroFTP CLI - Production command-line client (vault profiles, JSON output, batch scripting, agent discovery)
└── AeroPlayer - Media player with visualizers
Turn any server into a private personal cloud. Reliable sync across the mature AeroCloud protocol set (including SFTP, S3, Azure, WebDAV, Google Drive, Dropbox, OneDrive, Jottacloud, kDrive, Koofr, and OpenDrive), plus additional provider integrations tracked in the protocol matrix. Bidirectional sync, tray background sync, selective sync, file versioning, .aeroignore, share links, and per-project local folders.
| Protocol | Encryption | Features |
|---|---|---|
| FTP | None / Explicit TLS / Implicit TLS | MLSD/MLST (RFC 3659), resume transfers, TLS mode selection |
| FTPS | TLS/SSL (Explicit + Implicit) | Certificate verification options, self-signed cert support |
| SFTP | SSH | Key authentication, host key verification (TOFU), ed25519/RSA, hybrid upload (SCP) |
| WebDAV | HTTPS | Nextcloud, Felicloud, CloudMe, Koofr, Jianguoyun, InfiniCLOUD, Seafile. HTTP Digest auth (RFC 2617), file locking (RFC 4918), OCS share links + trash for Nextcloud-based servers |
| S3 | HTTPS | AWS S3, MEGA S4, MinIO, Backblaze B2, Wasabi, Cloudflare R2, Alibaba OSS, Tencent COS. Multipart upload |
| Google Drive | OAuth2 PKCE | File versions, thumbnails, share links (view/comment/edit permissions), workspace export |
| Dropbox | OAuth2 PKCE | File versions, thumbnails, share links (password + expiry on Pro+) |
| OneDrive | OAuth2 PKCE | Resumable upload, file versions, share links (password on Personal, expiry) |
| MEGA.nz | Client-side AES | 20GB free, end-to-end encrypted, zero-knowledge, share links |
| Box | OAuth2 PKCE | 10GB free, enterprise-grade, file versions, share links (password + expiry on paid plans) |
| pCloud | OAuth2 | 10GB free, US/EU regions, file versions, share links (password + expiry on Premium) |
| Azure Blob | HMAC-SHA256 / SAS | Enterprise blob storage, container-based, XML API |
| 4shared | OAuth 1.0 (HMAC-SHA1) | 15GB free, native REST API, folder/file management |
| Filen | Client-side AES-256-GCM | 10GB free, zero-knowledge E2E encryption, share links (password + expiry presets) |
| Internxt Drive | Client-side AES-256-CTR | 1GB free, E2E encrypted, BIP39 mnemonic, optional 2FA |
| kDrive | API Token (Bearer) | 15GB free, Swiss-hosted by Infomaniak, share links (password + expiry on paid plans) |
| Zoho WorkDrive | OAuth2 | 5GB free, 8 regional endpoints, share links (password + expiry), team drive management |
| Jottacloud | Login Token (Bearer) | 5GB free, Norwegian-hosted, share links, unlimited storage plans |
| Koofr | OAuth2 PKCE | 10GB free, EU-based (Slovenia), native REST API, share links, trash management |
| Felicloud | WebDAV + OCS API | 10GB free, EU/GDPR, Nextcloud-based, share links (password + expiry), trash management |
| FileLu | API Key (native REST) | 1GB free, file/folder passwords, privacy toggle, share links, server clone, remote URL upload, trash management |
| Yandex Disk | OAuth2 Token | 5GB free, Russian cloud storage, share links, trash management, MD5 checksums, server-side copy |
| OpenDrive | Username/Password | 5GB free, session-based auth, MD5 checksums, trash management, share links (expiry) |
| GitHub | PAT / Device Flow | Repository as filesystem, single-file commits plus atomic batch upload/delete flows, release assets (2 GiB), branch workflow for protected branches, auto PR creation |
| SourceForge | SSH (SFTP) | Coming soon - SFTP preset with SourceForge project paths, file release management |
Cloud features: Background sync via cloud provider factory (direct-auth, OAuth2, OAuth1) with maturity badges shown in the setup wizard. 4-step setup wizard with saved server profiles, selective sync (folder exclusion), .aeroignore patterns, file versioning (.aeroversions/), sync index cache for conflict detection, storage quota display where the provider exposes it, share links, and Dropbox-style conflict naming.
Native OS File Manager Badges (v2.0.4+): Green checkmark on synced files, blue arrows on syncing files, red X on errors - directly inside Nautilus, Nemo, and GIO-based file managers on Linux. On Windows (v2.0.5), native Explorer sync icons via Cloud Filter API with Named Pipe IPC server. Tray icon with colored badge dots (checkmark/sync arrows/X mark overlays). One-click install on Linux, automatic on Windows.
A full-featured local file manager built into AeroFTP. Toggle between remote and local modes, or use both side-by-side.
Enterprise-grade file synchronization with operational reliability features built for real-world use.
Create, manage, and browse encrypted containers that protect your files with a security stack that exceeds industry standards. The encryption engine is published as the standalone aerovault crate on crates.io for use in any Rust project.
AeroVault v2 (.aerovault containers)
| Component | Algorithm | Details |
|---|---|---|
| Content encryption | AES-256-GCM-SIV (RFC 8452) | Nonce misuse-resistant - even nonce reuse doesn't compromise security |
| Key wrapping | AES-256-KW (RFC 3394) | Built-in integrity check on unwrap |
| Filename encryption | AES-256-SIV | Deterministic - file names are hidden, not just content |
| Key derivation | Argon2id | 128 MiB memory / 4 iterations / 4 parallelism (exceeds OWASP 2024) |
| Header integrity | HMAC-SHA512 | 512-bit MAC, quantum-resistance margin |
| Cascade mode | ChaCha20-Poly1305 | Optional double encryption layer for defense-in-depth |
| Chunk size | 64 KB | Per-chunk random nonce + authentication tag |
Open format: The
.aerovaultbinary format is fully documented in the AeroVault v2 Specification with implementation guides for Rust, Java, Python, Go, C, and JavaScript.
Additional encryption features:
The integrated development panel combining three tools in a tabbed interface.
An AI assistant with 47 provider-agnostic tools that work across local files and AeroFTP's remote provider backends. 19 AI providers, vision support, RAG indexing, plugin ecosystem with GitHub registry, and command palette.
Providers: OpenAI, Anthropic, Google Gemini, xAI Grok, OpenRouter, Ollama, Kimi (Moonshot), Qwen (Alibaba), DeepSeek, Mistral, Groq, Perplexity, Cohere, Together AI, AI21 Labs, Cerebras, SambaNova, Fireworks AI, Custom
Core capabilities:
Advanced features:
/ prefix activationAeroFTP is built for both humans and AI agents. As agentic AI, computer use, and autonomous coding assistants become the standard way to interact with computers, AeroFTP provides native interfaces for both use cases.
For AI Agents (CLI): Tools like Claude Code, Open Interpreter, Cline, Aider, Devin, Codex, Cursor Agent, Windsurf, and other agentic frameworks can call aeroftp-cli directly. Structured --json output, vault-based --profile credentials (agents never see passwords), semantic exit codes, and .aeroftp batch scripts make AeroFTP a first-class tool in any agent's toolkit. External agents can also invoke aeroftp-cli agent to orchestrate AeroAgent as a credential-isolating proxy for multi-server operations. See Agent Orchestration for the full orchestration guide, CLI reference, and a verified field test report.
For Humans (GUI + AeroAgent): The desktop app provides drag-and-drop file management with AeroAgent, the integrated AI assistant offering 48 tools across local files and remote providers. AeroAgent supports multi-step autonomous execution, tool approval workflows with backend-enforced grants, and 19 AI providers.
A production command-line interface sharing the same Rust backend as the GUI. It provides structured JSON output, glob pattern transfers, encrypted vault profiles, batch scripting, and agent discovery across the supported URL schemes and saved-profile providers.
# Zero-credential connection via saved profiles
aeroftp-cli ls --profile "My Server" /var/www/ - l
# List all saved servers from encrypted vault
aeroftp-cli profiles
# URL-based connection (classic mode)
aeroftp-cli ls sftp://user@myserver.com /var/www/ - l
# Download with glob patterns
aeroftp-cli get sftp://user@host "/data/*.csv"
# Pipe-friendly: data on stdout, messages on stderr
aeroftp-cli cat sftp://user@host /config.ini | grep DB_HOST
# OAuth providers via profile (Google Drive, Dropbox, OneDrive, etc.)
aeroftp-cli ls --profile "My Google Drive" /
Commands: connect, ls, get, put, mkdir, rm, mv, cat, head, tail, touch, hashsum, check, find, stat, df, tree, about, dedupe, sync, link, batch, profiles
Protocols: FTP, FTPS, SFTP, WebDAV, S3, GitHub, MEGA, Azure, Filen, Internxt, Jottacloud, FileLu, Koofr, OpenDrive, Yandex Disk, Felicloud + OAuth providers via --profile (Google Drive, Dropbox, OneDrive, Box, pCloud, Zoho WorkDrive, kDrive, 4shared)
Features:
--profile vault profiles - connect to any saved server without exposing credentials. Fuzzy name matching with disambiguation. Designed for AI agent workflows--json structured output for all commands*.csv, *.json).aeroftp batch scripts with variables, error policies, and 17 commandsNO_COLOR / CLICOLOR complianceSee the full CLI Guide for usage, examples, profiles, and batch scripting reference.
AeroFTP CLI is designed for autonomous use by AI coding agents and CI/CD pipelines. The --profile flag is the key enabler - agents connect to servers without ever seeing passwords:
--profile "Name" - connect via encrypted vault, zero credentials in the command line, shell history, or process list--json on every command - structured output parsable by any agent (Claude Code, Codex, Cursor, Devin)NO_COLOR compliant - no ANSI escape sequences polluting agent output.aeroftp) - define multi-step deployment flows as files, execute atomically# AI agent deploys a website - no credentials anywhere
aeroftp-cli put --profile "Production" ./dist/app.js /var/www/app.js
aeroftp-cli sync --profile "Staging" ./build/ /var/www/ --dry-run
# CI/CD with env-based vault unlock
AEROFTP_MASTER_PASSWORD=$SECRET aeroftp-cli put --profile "Deploy" ./dist/ /www/ - r
AeroAgent (the built-in AI assistant) can also orchestrate remote server operations via
server_exectool - listing files, reading configs, uploading/downloading across any saved server, with credentials resolved securely from the vault.
As of March 2026, no other file transfer client, cloud storage CLI, or multi-protocol transfer tool provides native credential isolation for AI agents operating on remote servers. Existing tools in this category store credentials in plaintext files, reversible encodings, or OS keystores accessible to any same-user process. Credential proxy services that have emerged for AI workflows only cover HTTP APIs - they cannot handle FTP, SFTP, WebDAV, or OAuth token refresh cycles.
AeroFTP solves this at the architecture level. The --profile flag and AeroAgent server_exec tool resolve credentials exclusively inside the Rust backend process, from an AES-256-GCM encrypted vault. The credential material never crosses the IPC boundary - the agent receives only operation results, never the authentication material that produced them. This works across direct-auth, token-based, and browser-authorized cloud providers.
Read the full analysis: Credential Isolation - architecture, protocol coverage, and implementation references. See also Agent Orchestration for the complete orchestration guide with external agent integration and verified field test report.
Built-in media player with GPU-accelerated visualizations and professional audio processing.
<audio> + Web Audio APIAeroFTP incorporates privacy protections that go beyond what traditional file managers offer.
| Feature | Details |
|---|---|
| Master Password | Optional Argon2id vault encryption - all credentials locked behind a single password |
| Encrypted Vault | All sensitive data in AES-256-GCM encrypted storage - zero plaintext on disk |
| Zero Telemetry | No analytics, no phone-home, no network requests beyond user-initiated connections |
| Memory Zeroization | Passwords and keys cleared from RAM immediately after use |
| Clearable History | One-click clear for recent locations. No persistent browsing traces |
| Portable Deployment | AppImage runs without installation. Remove it and the config directory - no traces remain |
See SECURITY.md for the security policy and architecture summary, and docs.aeroftp.app/security for the complete security documentation with encryption specs, AI security model, supply chain details, and audit history.
| OpenSSF Best Practices | 100% passing - all 67 criteria met |
| Aikido Security | Continuous SAST/SCA monitoring - Top 5% benchmark, OWASP Top 10 coverage, 0 open issues |
| Socket.dev | Supply chain SCA monitoring on every push - dependency risk scoring, typosquatting detection |
| Dependency Scanning | 1,156 packages monitored (320 JS + 836 Rust), daily automated scans |
| Supply Chain | All GitHub Actions pinned to SHA hashes, Dependabot enabled, Sigstore signing with client-side verification |
| Security Audits | 300+ findings resolved across 9 independent audits - grade A- |
| Security Audit | March 2026 - February 2026 (Aikido Security) |
Light, Dark, Tokyo Night, and Cyber - with themed icons, terminal colors, Monaco editor syntax, and CSS custom properties throughout.
Hash Forge (MD5, SHA-1, SHA-256, SHA-512, BLAKE3), CryptoLab (AES-256-GCM, ChaCha20-Poly1305 encrypt/decrypt), Password Forge (CSPRNG + BIP39 passphrase generator with entropy display).
Quality-audited translations with native script integrity. Automatic browser language detection.
| 🇬🇧 English | 🇮🇹 Italian | 🇩🇪 German | 🇪🇸 Spanish | 🇫🇷 French |
| 🇵🇹 Portuguese | 🇷🇺 Russian | 🇯🇵 Japanese | 🇰🇷 Korean | 🇨🇳 Chinese |
| 🇮🇳 Hindi | 🇧🇩 Bengali | 🇹🇷 Turkey | 🇵🇱 Polish | 🇳🇱 Dutch |
| 🇸🇪 Swedish | 🇩🇰 Danish | 🇳🇴 Norwegian | 🇫🇮 Finnish | 🇮🇸 Icelandic |
| 🇨🇿 Czech | 🇭🇺 Hungarian | 🇷🇴 Romanian | 🇺🇦 Ukrainian | 🇬🇷 Greek |
| 🇹🇭 Thai | 🇻🇳 Vietnamese | 🇮🇩 Indonesian | 🇲🇾 Malay | 🇵🇭 Filipino |
| 🇰🇭 Khmer | 🇬🇪 Georgian | 🇦🇲 Armenian | 🇧🇬 Bulgarian | 🇭🇷 Croatian |
| 🇷🇸 Serbian | 🇸🇰 Slovak | 🇸🇮 Slovenian | 🇲🇰 Macedonian | 🇪🇪 Estonian |
| 🇱🇹 Lithuanian | 🇱🇻 Latvian | 🏴 Welsh | Catalan | Galician |
| Basque | 🇰🇪 Swahili |
sudo snap install aeroftp
Note: Snap has limited filesystem access due to strict confinement. For full access, use .deb, .AppImage, or AUR.
yay - S aeroftp-bin
# or
paru - S aeroftp-bin
Available on Arch Linux and derivatives (Manjaro, EndeavourOS, Garuda). Binary package - no compilation needed.
Visit launchpad.net/aeroftp for PPA instructions and .deb packages.
Download from GitHub Releases:
winget install axpnet.AeroFTP
Available on Windows 10 (1709+) and Windows 11. Requires App Installer from Microsoft Store.
Download from GitHub Releases:
Note: Windows builds are not currently published on the Microsoft Store. The installer is not code-signed (no EV certificate), so Windows SmartScreen may show a warning on first run - this is safe to dismiss.
Download from GitHub Releases:
Note: The macOS build is not notarized (no Apple Developer certificate). macOS Gatekeeper will block the app on first launch - right-click the app and select "Open" to bypass. See #47 for known issues on Apple Silicon.
All release artifacts are signed with Sigstore using keyless signing via GitHub OIDC. Each release includes .sigstore.json verification bundles.
Install cosign, then verify any downloaded artifact:
cosign verify-blob \
--bundle AeroFTP_3.1.3_amd64.deb.sigstore.json \
--certificate-identity "https://github.com/axpdev-lab/aeroftp/.github/workflows/build.yml@refs/tags/v3.1.3" \
--certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
AeroFTP_3.1.3_amd64.deb
This proves the artifact was built by our CI pipeline from the tagged commit. Replace filenames and version with your download.
AeroFTP is free and open source software. If you find it useful, please consider supporting its development:
bc1qdxur90s5j4s55rwe9rc9n95fau4rg3tfatfhkn0x08F9D9C41E833539Fd733e19119A89f0664c3AeE25A8sBNqzbR9rvrd3qyYwBkwirEh1pUiegUG6CrswHrdLTk8iRvUqAtYyer8SPAkEAakpPXxfFY1D1Contributions are welcome. Please open an issue to discuss proposed changes before submitting a pull request.
GPL-3.0 - See LICENSE for details.
|
|
|
|
| OIN 2.0 Community Member | OSI Individual Member | Sigstore Signed Releases |
Built with Rust (Tauri 2) + React 18 + TypeScript
Designed, architected and maintained by axpnet.
AI tools (Claude Code, Codex, Gemini) were used extensively for translations, code review,
implementation and documentation, always under strict human-defined specifications and patterns.
Every feature, design decision and architectural choice is human-driven.
AI accelerated development; it did not direct it.
Full AI Transparency Statement