Boxie
New Share Paste
English Español Français Deutsch 中文 Português 日本語

Help & Features

Everything you can do with Boxie.

Uploading Files

Go to the home page and drag & drop files onto the upload area, or click to browse. Multiple files can be uploaded at once — each becomes its own share link.

  • Folders — dragging a folder automatically zips it before upload.
  • Images — a preview thumbnail is generated. Resize on download with ?w=800 in the URL.
  • Code files — automatically syntax-highlighted with selectable color themes.
  • Markdown — rendered as formatted HTML on the view page.
  • PDFs — displayed inline; page count shown in the sidebar.
  • Photos with EXIF — camera model, aperture, shutter speed, ISO, and GPS map shown in the sidebar.

After uploading you receive a shareable link. Anyone with the link can view and download (subject to any restrictions you set).

Code Pastes

Use Paste to share a code snippet without uploading a file.

  • Auto-detect — Boxie analyses the content to identify the language automatically.
  • Explicit language — pick from the dropdown (Go, Python, Rust, SQL, and 20+ more).
  • Color themes — switch highlight themes (Dracula, Monokai, GitHub, Nord, etc.) in the code view.
  • Raw & download — every paste has a Raw link and a Download button.
  • Tab key — inserts 4 spaces in the editor.

Share Types

Type Expiry Token style
Permanent Never word-word-N memorable token
7-Day 7 days word-word-N memorable token
24-Hour 24 hours Short hex token
Pickup Once On first download Short hex token — burns after reading

Admins can change the share type after upload from the Admin panel.

Groups

Group multiple files into a single shareable gallery.

  • Enable Group Files on the upload form to create a new group, or add files to an existing group.
  • Groups get their own URL /g/{token} showing a card grid of all members.
  • Click any card to preview the file inline; click again to download.
  • A Download All button zips the entire group on the fly.
  • Groups can have their own IP allowlist — when a group grants access, its members are accessible regardless of their individual settings.
  • Groups are automatically pruned when all member files expire.

Set a vanity slug for a human-friendly URL.

  • Available on single-file uploads and pastes via the Custom link field before sharing.
  • Format: lowercase letters, numbers, hyphens; 3–50 characters. Example: my-logo → /s/my-logo
  • Admins can set or change slugs after upload from the edit page.
  • The original hex/word token always continues to work as well.

Access Control

IP / CIDR Allowlist

Restrict a share to specific IP addresses or network ranges. Leave blank for unrestricted public access.

10.0.0.0/8, 192.168.1.5, 2001:db8::/32

Password Protection

Require a password before anyone can view or download a share. The password is bcrypt-hashed — Boxie never stores it in plain text. Unlock cookies last 1 hour per browser session.

Inline Embedding

The /s/{token}/img route serves a file inline with the correct Content-Type — no download prompt — ideal for embedding in wikis, Markdown documents, or websites.

<img src="https://boxie.to/s/bright-crane-42/img?w=800">

Optional ?w=N and/or ?h=N query params resize images on the fly. This route does not increment the download count.

REST API

Boxie has a full REST API for programmatic access. See the API documentation for complete details.

  • Authenticate with an API key (Authorization: Bearer bxk_…) or session cookie.
  • Create API keys from your Account page. Each key can be named and revoked individually.
  • Endpoints cover shares (list, get, upload, delete), pastes, and groups.
curl -H "Authorization: Bearer bxk_…" \
  -F "file=@photo.jpg" \
  -F "share_type=permanent" \
  https://boxie.to/api/v1/shares

Account & Access

  • Passkeys — Boxie uses WebAuthn passkeys (Touch ID, Face ID, hardware keys). No passwords to remember. Add multiple passkeys for backup access.
  • Invites — generate invite links to onboard others (up to 5 per 30 days for regular users; unlimited for admins). Invites expire after 7 days.
  • API Keys — generate named Bearer tokens for scripts and integrations. Keys are hashed; shown only once at creation.
  • Activity Journal — a log of your uploads, deletes, logins, and API actions. Admins see all users’ activity.
  • Storage quota — each account has a storage limit shown on your Account page. Contact support to increase it.

Manage your settings at /account.

Questions? Email support@boxie.to