R2 Web is a lightweight, browser-native file manager for Cloudflare R2 buckets that runs entirely in the browser and calls the R2 S3 API directly, intended for anyone who needs a fast, cross-platform way to browse, upload, organise and share objects without installing a desktop client or learning a command-line tool.

What it is

R2 Web is a Web-native file manager for Cloudflare R2 storage, written in JavaScript and released under the MIT licence. The whole application is a static site built on native Web APIs with no framework and no build step: the src directory in the repository is itself the deployment artifact, which keeps it small enough to audit, modify and self-host. Every operation travels from the browser straight to the R2 S3 API, so neither files nor credentials pass through a third-party backend.

It fills the gap between Cloudflare's own console and heavier alternatives. The Cloudflare console is adequate for basic operations but inefficient when browsing, moving, renaming or temporarily uploading large numbers of files; desktop clients require an installation; and a CLI is not suitable for everyone. R2 Web offers an interface that is ready whenever it is needed, works across platforms, and concentrates on file management — paginated directory browsing, lazy-loaded thumbnails, previews, sorting and batch operations — rather than on administration.

Key capabilities

• Pure client-side direct connection to the R2 S3 API, with credentials held only in the browser's localStorage and no relay server in the path.
• Multipart uploads of up to 1 TiB per file with automatic chunking, concurrent uploads, pause and resume, live speed and size progress, and conflict handling.
• Filename templates using [name], [ext], [hash:N], date, timestamp, UUID and directory placeholders, for example images/[date:YYYY/MM/DD]/[uuid].[ext] or backup/[timestamp]-[name].[ext].
• Local image compression for JPEG, PNG, WebP and AVIF through WebAssembly inside the browser, with Tinify available as an alternative that sends images to the Tinify service.
• Previews for images, video, audio and text, plus shareable links as a direct URL, QR code, Markdown or HTML.
• Directory management covering paginated listings, name/date/size sorting, batch selection, copy, move, rename and recursive delete.
• Zero-build deployment from src, with PWA support, light and dark themes, and zh / zh_TW / en / ja localisation.

Who uses it and how

• Image-hosting workflows, where drag-and-drop or paste uploads combine with filename templates, local compression and one-click Markdown or HTML link copying.
• Routine bucket housekeeping at a scale the Cloudflare console handles poorly: sorting through many objects, then moving, renaming or recursively deleting them in batches.
• Self-hosters who fork or clone the repository and publish the src directory as a static site on Vercel, Netlify or Cloudflare Pages.
• Users who prefer no deployment at all, using the hosted instance at r2.viki.moe after configuring bucket CORS.
• People synchronising settings between devices through a generated configuration link or QR code, which the README warns contains the R2 credentials and must be passed only over trusted channels.

Getting started

Configure a CORS policy on the R2 bucket that allows GET, POST, PUT, DELETE and HEAD and exposes the ETag header, then open the hosted instance at r2.viki.moe and enter the Account ID, Access Key ID, Secret Access Key and Bucket Name from an R2 API token scoped to that bucket. Alternatively, deploy the src directory as a static site to Vercel, Netlify or Cloudflare Pages, or serve it locally with npx serve src, and add the resulting domain to AllowedOrigins.

How it compares

The README positions R2 Web alongside, rather than against, the tools already used for R2: the Cloudflare console, the official SDK, CLIs and rclone. It is the graphical, install-free option among them, while the README states plainly that it does not replace complex permission management, automation scripts or API integrations.

When to use it — and when not to

There is no server-side component to operate — no database, object store of its own or SMTP — but a self-hoster must still publish static files and maintain a correct CORS policy that allows POST, PUT and DELETE and exposes ETag, without which multipart uploads fail. Credentials live in localStorage and each configuration targets a single bucket, so a bucket-scoped, least-privilege API token is essential, and configuration share links should be treated as secrets. Anyone who needs role-based access control, scheduled scripting or programmatic API integration should stay with the Cloudflare console, the official SDK, a CLI or rclone.

[
  {
    "AllowedOrigins": ["https://r2.viki.moe"],
    "AllowedMethods": ["GET", "POST", "PUT", "DELETE", "HEAD"],
    "AllowedHeaders": ["*"],
    "ExposeHeaders": ["ETag"],
    "MaxAgeSeconds": 86400
  }
]

git clone https://github.com/vikiboss/r2-web.git
cd r2-web
pnpm install

npx serve src
# 或
python3 -m http.server 5500 --directory src