News & Releases

S3 Explorer — manage S3-compatible object storage from your desktop

Cross-platform Tauri + Vue 3 client supporting AWS S3, MinIO, Backblaze B2, Cloudflare R2, and 17+ other S3-compatible providers.

What's new in v0.3.11

🔑 More reliable license checks

• Lifetime licenses are never suspended because of network problems. If the license server cannot be reached (offline, VPN, corporate proxy), your lifetime license stays active. It is only removed if the server says it was refunded, disabled or moved to another machine.
• Checks are retried automatically. A check that fails is tried again a few seconds later, then in the background after 1, 5 and 15 minutes, then every hour, so a VPN that reconnects is enough.
• "Retry verification" in Settings → License. When the license could not be verified for a while, a short note at the top of Settings points to it. The License tab shows the last verification date, a "Retry verification" button and a shortcut to the connection test. Retrying never uses another activation.
• Typing your key again no longer uses an activation when your license was only suspended: S3 Explorer checks your existing activation first.

Subscriptions keep their 35-day offline period.

🌍 Your system's language, from the first launch

On a new install, S3 Explorer starts in your system's language when it is one of the 10 available languages (English, Chinese, Hindi, Spanish, French, Arabic, Bengali, Portuguese, Indonesian, Romanian), and in English otherwise. Until you choose a language in Settings → Language, it follows your system's language when you change it. Existing installs keep their current language.

☁️ France Nuage

France Nuage, S3-compatible object storage hosted in France, is now in the provider list: pick it when adding a connection and the endpoint is filled in for you.

📊 Anonymous usage statistics

When anonymous statistics are enabled, failed license checks now report the kind of network problem (for example a timeout or a proxy refusing the connection) and whether a proxy is used, never its address. This helps fix connection problems on corporate networks.

Downloads

Platform	Download
macOS (Universal — Intel + Apple Silicon)	.dmg
Windows x64	.exe · .msi
Windows ARM64 (Snapdragon, Surface Pro X)	.exe · .msi
Linux x64	.AppImage · .deb · .rpm
Linux ARM64 (Raspberry Pi, ARM servers)	.AppImage · .deb · .rpm

Installation Notes

macOS

• Download the .dmg, open it, and drag S3 Explorer to Applications
• On first launch, the app is signed with Apple Developer ID — should open without warning

Windows

• Recommended: .exe setup (NSIS installer, supports auto-update)
• Enterprise / managed deployment: .msi (Group Policy / SCCM compatible)

Linux

• Debian / Ubuntu / derivatives: sudo dpkg -i S3.Explorer_*.deb
• Fedora / RHEL / openSUSE: sudo rpm -i S3.Explorer-*.rpm
• Other distros: .AppImage is portable — chmod +x and run

S3 Explorer — manage S3-compatible object storage from your desktop

Cross-platform Tauri + Vue 3 client supporting AWS S3, MinIO, Backblaze B2, Cloudflare R2, and 17+ other S3-compatible providers.

What's new in v0.3.10

🎄 Holiday theme

From December 1 to January 15, S3 Explorer dresses up for the holidays:

• pine-green and gold colors;
• snow and Santa's sleigh at launch, until your first click or key press;
• a small sleigh going back and forth in the empty search field (it fades out as soon as you click in it), and a garland at the top of the sidebar;
• a little snowman that builds itself on the welcome screen and in empty folders.

The animations pause while S3 Explorer is in the background. Everything returns to the usual look on January 16. You can turn it off at any time in Settings → Appearance → Holiday theme. If your system is set to reduce motion, nothing moves: the colors, a still garland and the snowman, already built, remain.

🗂️ Compact view by default

The compact view, which fits more files on screen, is now the default. If you never chose a view mode, S3 Explorer switches to it with this update. If you picked the normal view, it stays that way. You can change it in Settings → Appearance → View Mode.

The toolbar above the file list is also slimmer, which gives the list a little more room.

🐛 Fixes

• Prices in the license reminder and in the connection-limit dialog are now shown in euros, the currency licenses are billed in. They were shown in dollars.
• The status bar below the search field no longer slips behind the file list header while a search is running.
• The flags in Settings → Language now show on Windows, where they appeared as two letters ("FR", "GB"…).
• Editing a connection no longer removes the buckets you added to it by hand, and no longer shows it again in the sidebar if you had hidden it.
• In the unregistered version, the license reminder now waits at least 22 minutes after you close it before it can come back (10 minutes before).

Downloads

Platform	Download
macOS (Universal — Intel + Apple Silicon)	.dmg
Windows x64	.exe · .msi
Windows ARM64 (Snapdragon, Surface Pro X)	.exe · .msi
Linux x64	.AppImage · .deb · .rpm
Linux ARM64 (Raspberry Pi, ARM servers)	.AppImage · .deb · .rpm

Installation Notes

macOS

• Download the .dmg, open it, and drag S3 Explorer to Applications
• On first launch, the app is signed with Apple Developer ID — should open without warning

Windows

• Recommended: .exe setup (NSIS installer, supports auto-update)
• Enterprise / managed deployment: .msi (Group Policy / SCCM compatible)

Linux

• Debian / Ubuntu / derivatives: sudo dpkg -i S3.Explorer_*.deb
• Fedora / RHEL / openSUSE: sudo rpm -i S3.Explorer-*.rpm
• Other distros: .AppImage is portable — chmod +x and run

S3 Explorer — manage S3-compatible object storage from your desktop

Cross-platform Tauri + Vue 3 client supporting AWS S3, MinIO, Backblaze B2, Cloudflare R2, and 17+ other S3-compatible providers.

What's new in v0.3.9

Compatibility and comfort release. Deleting files now works the same on every S3-compatible server, buckets restricted to a few prefixes open again, licenses no longer disappear on their own, and the reminder shown in the unregistered version is much less intrusive.

🗑️ Reliable deletion on every S3-compatible server

Deleting a folder, a multi-selection or emptying a bucket used to fail on some servers with errors such as Missing required header for this request: Content-MD5 (Dell ECS, NetApp StorageGRID) or on servers that do not implement multi-object delete.

All bulk deletions now go through a single engine that adapts to each server instead of relying on a list of providers:

• Learns what the server accepts: it tries the integrity header older servers require (Content-MD5), then the one recent AWS SDKs send (CRC32), then both, and remembers what worked for the rest of the session.
• Falls back gracefully: smaller batches when the server limits their size, one request per file when multi-object delete is not implemented, automatic slow-down when the server throttles.
• Never assumes success: files the server neither confirmed nor reported as failed are deleted again.
• New: "Permanently delete all versions" in the file and folder menus of versioned buckets (disabled with an explanation on non-versioned buckets).
• Live progress with a Cancel button, and a report listing every file that could not be deleted, with a clear reason.

Also fixed along the way:

• Deleting Photos/ no longer removes photos/ from the search index.
• Deleted-file counts are no longer inflated by the folder marker being deleted twice.
• A multi-selection is deleted in batches instead of one request per file.
• The selection is cleared after a delete from the context menu.

🔓 Buckets restricted to specific prefixes now open

Some buckets are shared with a policy that only allows listing given prefixes, for example public/ (common on MinIO for anonymous or partner access). Such buckets could not be opened or indexed.

S3 Explorer now detects this case, opens the bucket with what you are allowed to see, and tells you once that the view is partial. If the root itself is denied, it suggests typing a path you know in the breadcrumb.

⚠️ Warning before creating names MinIO would hide

When an object report and a folder report/ exist side by side, MinIO keeps both but silently hides some of them from listings: the data is still there, it just becomes invisible.

Before an upload, drag-and-drop, paste, copy, new file, new folder or rename creates such a pair, S3 Explorer now asks for confirmation. The check reuses the folder already displayed whenever possible, so it adds no requests in the common case. The warning can be turned off per connection.

🔔 Fewer reminders in the unregistered version

The reminder inviting unregistered users to buy a license could reappear every two minutes during intensive use, and could pile up while the app was left open.

It now appears at most twice an hour, never less than 10 minutes after you close it, and never while one is already open. These limits are kept when the app is restarted.

🔑 Licenses stay activated

• Linux: a license could disappear a few seconds after the app started, typically when it was launched from a terminal or as an AppImage. Fixed.
• When a license cannot be confirmed, for example after more than 35 days offline, it is now set aside instead of erased: the next launch with an internet connection restores it automatically, without typing the key again or using another activation.
• Deactivating a license no longer removes it silently when the license server cannot be reached: S3 Explorer explains that this device may still count toward your activation limit, and lets you try again later or remove it anyway.

🎨 Title bar follows the app theme

The window title bar, drawn by the operating system, stayed light while the app was in dark mode (white text on white on macOS). It now follows the app's light, dark or system theme.

🛠️ Under the hood

• Anonymous usage statistics that the analytics server rejects are now reported in the app logs instead of being silently dropped.
• Frontend unit tests now run in continuous integration.

Downloads

Platform	Download
macOS (Universal — Intel + Apple Silicon)	.dmg
Windows x64	.exe · .msi
Windows ARM64 (Snapdragon, Surface Pro X)	.exe · .msi
Linux x64	.AppImage · .deb · .rpm
Linux ARM64 (Raspberry Pi, ARM servers)	.AppImage · .deb · .rpm

Installation Notes

macOS

• Download the .dmg, open it, and drag S3 Explorer to Applications
• On first launch, the app is signed with Apple Developer ID — should open without warning

Windows

• Recommended: .exe setup (NSIS installer, supports auto-update)
• Enterprise / managed deployment: .msi (Group Policy / SCCM compatible)

Linux

• Debian / Ubuntu / derivatives: sudo dpkg -i S3.Explorer_*.deb
• Fedora / RHEL / openSUSE: sudo rpm -i S3.Explorer-*.rpm
• Other distros: .AppImage is portable — chmod +x and run

Changelog

See the full changelog on the source repo.

S3 Explorer — manage S3-compatible object storage from your desktop

Cross-platform Tauri + Vue 3 client supporting AWS S3, MinIO, Backblaze B2, Cloudflare R2, Dell ECS, and 17+ other S3-compatible providers.

What's new in v0.3.8

Compatibility release. v0.3.7 was skipped — its work is folded into this version. Three independent improvements ship together: real S3-compat support, a much better network diagnostic, and a more usable browsing UI on long paths.

🪣 Real S3-compat — fix DeleteObjects on Dell ECS, MinIO, Cloudflare R2, Wasabi, Backblaze B2, Tigris…

A user on Dell ECS reported Operation failed: invalid request when deleting a folder with two files. The root cause turned out to be far broader than one provider:

The AWS SDK Rust 1.69+ flipped RequestChecksumCalculation from WhenRequired to WhenSupported, injecting a x-amz-sdk-checksum-algorithm: CRC32 header + x-amz-checksum-crc32 trailer over aws-chunked body encoding on every supporting operation. AWS S3 itself accepts both modes, but most S3-compat servers don't recognise the modern flexible-checksum framework and reject the request — Dell ECS as InvalidRequest, older MinIO as Missing required header: Content-MD5, Cloudflare R2 as NotImplemented: Header x-amz-checksum-crc32, and so on.

v0.3.8 ships a defense-in-depth fix:

• SDK upgrade — aws-sdk-s3 1.17 → 1.132, aws-config 1.1 → 1.8 (5 minors of upstream fixes, plus the future-proofing ChecksumAlgorithm::Md5 enum landing).
• RequestChecksumCalculation::WhenRequired — disables auto CRC32 injection on every operation that doesn't strictly need it (PutObject, ListObjectsV2, GetObject…). Restores the pre-2025 SDK behaviour that S3-compat servers know how to parse.
• New LegacyChecksumStripper interceptor — for the few operations like DeleteObjects whose Smithy trait declares httpChecksumRequired: true and ignore WhenRequired, this Smithy interceptor strips x-amz-checksum-*, x-amz-trailer, and x-amz-sdk-checksum-algorithm headers before transmit. Last line of defense.
• map_s3_error enriched — when an S3-compat server rejects a request, the user now sees the server's actual message (e.g. InvalidRequest: <Dell ECS message exact>) instead of our generic explanation. extract_server_message parses the <Message> field from the SDK's debug repr.

🔍 Network diagnostic — multi-step pipeline

The connectivity test in Settings → Advanced → Network was a single pass-or-fail probe — useful but opaque. v0.3.8 turns it into a full diagnostic pipeline:

Step	What it checks	What it tells you
DNS resolution	Resolves api.lemonsqueezy.com via system + DoH cascade (Cloudflare 1.1.1.1 + Google /resolve)	All IPs returned, suspicious responses (loopback / RFC1918), latency
TCP connect	Opens a socket to each resolved IP	Per-IP connect time, happy-eyeballs IPv4↔IPv6 fallback if one family is broken
TLS handshake	Negotiates TLS through your configured proxy + OS trust store	Certificate chain length, verified subject, cipher suite
API contract	HEAD /v1/licenses/activate	Confirms the endpoint actually responds (catches transparent gateway errors)
Sanity	Response analysis	Detects body redirection / captive portals

Each step shows its outcome (ok / warning / error / skipped), a human message, structured details, and elapsed milliseconds — so when the License tab fails, you can see exactly which layer broke.

Other related fixes:

• DNS multi-IP — resolve_with_fallback now returns Vec<IpAddr> instead of Option<IpAddr>. Some hosts (especially in corporate networks behind /etc/hosts overrides or split-horizon DNS) have multiple A/AAAA records, and we previously dropped all but the first — breaking happy-eyeballs IPv4↔IPv6 fallback.
• Coherent HTTP client — build_http_client_for_host factored so license activation and the diagnostic share the same TLS/proxy/DNS configuration. No more "diagnostic says OK, activation fails".

🧭 Adaptive breadcrumb

The breadcrumb in ObjectBrowser had two failure modes on long paths: it overflowed off the right edge (cutting the current folder, the most important segment), and it hid intermediate segments under ... without a way to read them.

v0.3.8 reworks it as an adaptive component:

• 5-step truncation strategy based on the actual toolbar width (measured via ResizeObserver):
  1. Show all segments full
  2. Collapse middle: [first, "...", last]
  3. Truncate first: [first_t, "...", last]
  4. Drop first entirely: ["...", last]
  5. Last resort: ["...", last_truncated_with_ellipsis]
• The current folder is always visible — truncated mid-name (hhh...hhh) only when the window is genuinely too narrow.
• truncateMiddle(text, max) + truncateEnd(text, max) helpers in formatters.ts.
• The pill is content-sized — when the path is short, the freed space goes to the search bar (which had a needless max-w-md cap, now removed).
• Click-to-edit mode keeps the pill's exact width so the box doesn't shrink/grow when toggling between view and edit.

📂 Indexation behaviour — explicit "no auto-indexing"

Settings → Performance → max indexing requests had a 1-100 range, with no way to disable indexing for very large buckets where the user just wants to navigate. v0.3.8 expands this to 0-5000:

• 0 = no indexing on bucket open at all (counts/sizes display as —, manual Full Index button still works)
• 1-5000 = caps the auto-indexing at that many ListObjectsV2 calls
• The Full Index button uses an internal u32::MAX sentinel to bypass any cap

🪟 UI compaction

• BucketList — bucket creation date moved from the card body into a tooltip on the bucket name. Card padding tightened from p-3 to px-3 py-2. Saves ~16-18 px per card → roughly one extra bucket visible on screen.
• Sidebar footer — Metrics & Settings buttons row padding p-4 → p-2. Footer height 68 px → 52 px (-16 px = ~1 bucket row reclaimed for the list).

🐛 Licensed users no longer see the purchase popup

The NagPopup (5 min timer + click-based trigger that nudges unregistered users to buy a license) was reading the frontend license store at trigger time. The store was only hydrated when the user opened Settings → License — at boot it stayed at 's0' (unregistered), so the popup fired even on machines with a valid licence active in profiles.json.

App.vue now hydrates the store via licenseStore.checkStatus() on mount, before any popup timer can fire. The backend remains the source of truth (license stays validated against Lemon Squeezy, machine-bound, tampering-detected) — we just stopped reading a stale frontend cache.

Internal

• AWS SDK upgrade brings 5 minors of upstream fixes for free (retry logic, IMDS handling, DNS caching).
• New file s3_compat.rs — small, self-contained Smithy interceptor with unit tests.
• s3_errors.rs gained extract_server_message + 4 unit tests covering the parsed/empty/long/missing cases.
• 74 cargo tests passing.

Downloads

Platform	Download
macOS (Universal — Intel + Apple Silicon)	.dmg
Windows x64	.exe · .msi
Windows ARM64 (Snapdragon, Surface Pro X)	.exe · .msi
Linux x64	.AppImage · .deb · .rpm
Linux ARM64	.AppImage · .deb · .rpm

Existing v0.3.6 users on Linux/Windows will receive v0.3.8 automatically via the in-app updater. macOS users will receive it once the macOS bundle is uploaded.

S3 Explorer — manage S3-compatible object storage from your desktop

Cross-platform Tauri + Vue 3 client supporting AWS S3, MinIO, Backblaze B2, Cloudflare R2, and 17+ other S3-compatible providers.

What's new in v0.3.6

Major release focused on corporate network compatibility. v0.3.5 was skipped (folded into this release). Two related but distinct improvements ship together.

🌐 Real corporate proxy support (transparent + manual)

v0.3.4 added rustls + DoH for SSL-inspection / DNS sinkholing networks, but missed the most common corporate scenario: HTTP proxies (Zscaler, Cisco Umbrella, Palo Alto, etc.) where all traffic must transit through 127.0.0.1:9000 or a corporate gateway. A native Rust app didn't see those proxies the way the system browser does.

v0.3.6 adds a proper Network section in Settings → Advanced:

• Auto-detect (default) — reads system proxy from Windows registry (HKCU + HKLM Group Policy fallback), macOS SCDynamicStore, and Linux env vars (HTTPS_PROXY, HTTP_PROXY, ALL_PROXY with both upper/lower case). Works transparently for ~80% of corporate setups.
• Manual proxy — paste an http://, https:// or socks5:// URL. Import a Zscaler/corporate .pac file from disk or fetch from URL — we extract the first PROXY directive automatically.
• No proxy — explicit bypass for testing.
• Test connectivity button — sends a probe to LemonSqueezy with a synthetic key (no activation slot consumed) and reports DNS / TCP / TLS / proxy errors with empathetic messages.

When activation fails on a network error, a contextual hint banner now appears in the License tab pointing the user directly to the Network settings — one click to diagnose and configure.

🐛 Critical fixes

• Google DoH fallback was broken since v0.3.3 — wrong endpoint URL (/dns-query is wireformat-only on Google, JSON requires /resolve). The cascade was effectively a single point of failure on Cloudflare. Now fixed.
• Lemon Squeezy live mode migration — product IDs updated to live mode following copyToLiveMode.

🔒 Security improvements

• PAC parser rejects directives pointing to loopback (127/8), link-local incl. cloud metadata (169.254.169.254), and IPv6 equivalents (::1, fe80::/10). RFC1918 ranges (10/8, 172.16/12, 192.168/16) remain allowed for legitimate corporate use.
• Detected proxy URLs are sanitized — user:pass@ Basic Auth credentials in env vars are stripped before display in the UI or logs.
• Connectivity probe is rate-limited (2 seconds minimum between calls) to prevent IP bans on Lemon's API from accidental UI spam.

Coverage matrix

Network configuration	v0.3.4	v0.3.6
Open Internet	✅	✅
DNS sinkhole only	🟡 (Cloudflare DoH only — Google branch broken)	✅ (cascade actually has 2 working branches now)
SSL inspection proxy only	✅	✅
DNS sinkhole + SSL inspection	✅	✅
Corporate HTTP proxy (Zscaler/Cisco/Palo Alto)	❌	✅
Whitelist-by-destination only (paranoid IT)	❌	❌ (still requires IT whitelist)

Downloads

Platform	Download
macOS (Universal — Intel + Apple Silicon)	.dmg
Windows x64	.exe · .msi
Windows ARM64 (Snapdragon, Surface Pro X)	.exe · .msi
Linux x64	.AppImage · .deb · .rpm
Linux ARM64	.AppImage · .deb · .rpm

Existing v0.3.4 users on Linux/Windows will receive v0.3.6 automatically via the in-app updater. macOS users will receive it once the macOS bundle is uploaded.

S3 Explorer — manage S3-compatible object storage from your desktop

Cross-platform Tauri + Vue 3 client supporting AWS S3, MinIO, Backblaze B2, Cloudflare R2, and 17+ other S3-compatible providers.

What's new in v0.3.4

Hotfix release for v0.3.3.

v0.3.3 introduced corporate network compatibility (platform TLS verifier + DoH cascade) but shipped with a critical bug: the app panicked silently on every launch because rustls 0.23+ requires a crypto provider to be installed at startup before any TLS code runs, and our migration replaced the previous implicit setup with an explicit one that didn't include this step.

v0.3.4 contains exactly that one fix — rustls::crypto::aws_lc_rs::default_provider().install_default() is now called once at the top of the app entry point, before any module that touches TLS (telemetry, license validation, DoH resolver). Everything else from v0.3.3 is unchanged: corporate SSL inspection proxies still work, DNS sinkhole bypass via DoH still works.

If you tried to install v0.3.3 and saw the app fail to launch (no window, no error message — just a process that exits within seconds), this release fixes it. Please redownload from the table below. Existing v0.3.2 users will receive v0.3.4 automatically via the in-app updater.

Carry-over from v0.3.3 — corporate network compatibility

Two complementary fixes that automatically activate only when needed (zero impact on home / café / regular Internet):

• TLS validation now uses the OS trust store instead of a fixed Mozilla CA bundle baked into the binary. License activation works behind enterprise SSL inspection proxies (Zscaler, Cisco Umbrella, Palo Alto, Symantec, Netskope, etc.) that intercept HTTPS with an IT-installed enterprise CA.
• DNS-over-HTTPS (DoH) fallback for license validation. When the system DNS resolver fails to resolve api.lemonsqueezy.com (corporate DNS sinkholing), the app falls back to Cloudflare's DoH endpoint, then Google's. The system resolver is always tried first.

The two work together: networks that combine DNS sinkholing AND SSL inspection (common in larger enterprises) now activate licenses where they couldn't before.

Coverage matrix

Network configuration	Result
Open Internet	✅ works
DNS sinkhole only	✅ works (DoH fallback)
SSL inspection proxy only	✅ works (platform verifier)
DNS sinkhole + SSL inspection	✅ works (both fixes combined)
Whitelist-by-destination only (paranoid IT)	❌ still requires IT whitelist

Downloads

Platform	Download
macOS (Universal — Intel + Apple Silicon)	.dmg
Windows x64	.exe · .msi
Windows ARM64 (Snapdragon, Surface Pro X)	.exe · .msi
Linux x64	.AppImage · .deb · .rpm
Linux ARM64 (Raspberry Pi, ARM servers)	.AppImage · .deb · .rpm

Installation Notes

macOS

• Download the .dmg, open it, and drag S3 Explorer to Applications
• On first launch, the app is signed with Apple Developer ID — should open without warning

Windows

• Recommended: .exe setup (NSIS installer, supports auto-update)
• Enterprise / managed deployment: .msi (Group Policy / SCCM compatible)

Linux

• Debian / Ubuntu / derivatives: sudo dpkg -i S3.Explorer_*.deb
• Fedora / RHEL / openSUSE: sudo rpm -i S3.Explorer-*.rpm
• Other distros: .AppImage is portable — chmod +x and run

Full source-level changelog

View full commit history on GitHub

⚠️ This release is broken — DO NOT install

v0.3.3 panics silently on launch on every machine due to a missing rustls
crypto provider initialization. The bug was introduced by the TLS migration
and slipped through testing because the crash leaves no stderr / crash log.

Use v0.3.4
instead — it ships the same corporate-network compatibility features
(platform TLS verifier + DoH cascade) plus the panic fix.

---

S3 Explorer — manage S3-compatible object storage from your desktop

Cross-platform Tauri + Vue 3 client supporting AWS S3, MinIO, Backblaze B2, Cloudflare R2, and 17+ other S3-compatible providers.

What's new in v0.3.3

This release is focused on a single goal: make the app work in restrictive corporate networks.

🛡️ Corporate network compatibility

Two complementary fixes that automatically activate only when needed (zero impact on home / café / regular Internet):

• TLS validation now uses the OS trust store instead of a fixed Mozilla CA bundle baked into the binary. This means license activation works behind enterprise SSL inspection proxies (Zscaler, Cisco Umbrella, Palo Alto, Symantec, Netskope, etc.), where IT installs a custom CA on managed machines to inspect HTTPS traffic. Previously, our app rejected those certificates as "not from a trusted root" and showed a generic "Network error" with no path forward; now it accepts them just like Chrome, Firefox and Outlook do.
• DNS-over-HTTPS (DoH) fallback for license validation. When the system DNS resolver fails to resolve api.lemonsqueezy.com (most commonly because of corporate DNS sinkholing of payment / e-commerce categories), the app automatically falls back to Cloudflare's DoH endpoint (https://1.1.1.1/dns-query), then Google's (https://dns.google/dns-query). The system resolver is always tried first and used when it works — so paying users on open networks see no behavioural change.

The two fixes work together: if the corporate network has both DNS sinkholing AND SSL inspection (a common combination in larger enterprises), the app will now activate licenses where it previously couldn't.

Coverage matrix

Network configuration	Before v0.3.3	After v0.3.3
Open Internet	✅ works	✅ works
DNS sinkhole only	❌ network error	✅ works (DoH fallback)
SSL inspection proxy only	❌ TLS error	✅ works (platform verifier)
DNS sinkhole + SSL inspection	❌ both layers fail	✅ works (both fixes combined)
Whitelist-by-destination only (paranoid IT)	❌ blocked	❌ still requires IT whitelist

Security note

The previous behavior pinned TLS to the Mozilla CA bundle as a defense against a narrow attack scenario (a local cracker installing a fake certificate authority in their own OS to impersonate our license server). This release accepts that trade-off because the practical security impact is minimal: a determined attacker can already reverse-engineer the binary to obtain the obfuscated identifiers needed to forge a server response. All other defenses are unchanged — HMAC machine-binding, constant obfuscation, the four dispersed validation checkpoints, anti-debug watchdog, AES-256-GCM credential encryption.

The DoH fallback queries Cloudflare and Google DNS over HTTPS only when the system resolver fails, never on the happy path — there is zero impact on users with normal connectivity.

Downloads

Platform	Download
macOS (Universal — Intel + Apple Silicon)	.dmg
Windows x64	.exe · .msi
Windows ARM64 (Snapdragon, Surface Pro X)	.exe · .msi
Linux x64	.AppImage · .deb · .rpm
Linux ARM64 (Raspberry Pi, ARM servers)	.AppImage · .deb · .rpm

Installation Notes

macOS

• Download the .dmg, open it, and drag S3 Explorer to Applications
• On first launch, the app is signed with Apple Developer ID — should open without warning

Windows

• Recommended: .exe setup (NSIS installer, supports auto-update)
• Enterprise / managed deployment: .msi (Group Policy / SCCM compatible)

Linux

• Debian / Ubuntu / derivatives: sudo dpkg -i S3.Explorer_*.deb
• Fedora / RHEL / openSUSE: sudo rpm -i S3.Explorer-*.rpm
• Other distros: .AppImage is portable — chmod +x and run

Full source-level changelog

View full commit history on GitHub

S3 Explorer — manage S3-compatible object storage from your desktop

Cross-platform Tauri + Vue 3 client supporting AWS S3, MinIO, Backblaze B2, Cloudflare R2, and 17+ other S3-compatible providers.

What's new in v0.3.2

✨ New features

• Incomplete multipart uploads cleanup — surfaces S3 multipart uploads that were started but never completed (a silent storage cost most users don't know about). A yellow ⚠ icon now appears on bucket cards in the sidebar when orphan uploads older than your configured threshold are detected. Click it to open a sortable, filterable table per bucket with single-row and bulk Abort actions, age filter (1h / 24h / 7d / Custom hours / All), live size aggregation across the orphans, and a confirm dialog before any destructive action. Universal across all 21 supported providers — uses the standard ListMultipartUploads / ListParts / AbortMultipartUpload S3 API, no provider-specific quirks. Configurable threshold under Settings → S3 / Storage → Incomplete upload threshold (hours), defaulting to 24 hours.

🛡️ License experience overhaul

• Offline grace extended from 7 days to 35 days — aligns with industry standard (Microsoft 365: 30 days, Adobe Creative Cloud annual: 99 days, Keygen.sh recommended default: 30 days) and accommodates legitimate offline scenarios such as travel, corporate firewalls, and slow-link work environments.
• Profiles are no longer auto-disabled when license downgrades. Previously, falling back to the free tier silently disabled connection profiles 6 and beyond. From v0.3.2 forward, all your existing profiles stay enabled forever — only the creation of new profiles past the free-tier limit is blocked.
• Empathetic downgrade modal at the actual transition event, with reason-specific wording for each cause (offline grace expired, server-side revocation, integrity check failure). Always reassures that profiles are intact and provides a concrete next step.
• Heads-up modal at day 30: if your license has been unable to sync for 30 days, you get a single non-intrusive notice that you have 5 days remaining, so you can plan to reconnect — no silent surprise on day 35.
• All new wording is deliberately reassuring rather than accusatory: no "license invalid" panic language, every message provides actionable guidance.

🔧 Improvements

• Fix: suppress an unused-variable compiler warning in release builds of the cache manager (cosmetic only — no behavior change).
• Telemetry: license tier sent to PostHog now uses a single shared vocabulary (monthly / lifetime) across web (purchase events) and desktop (activation events), so funnels can join correctly on the tier field.

🛡️ Security

All existing defenses are preserved unchanged: HMAC machine-binding on the license file (so the config can't be moved between machines), NTP-verified time-skew detection, anti-debug watchdog (still silent on detection by design), AES-256-GCM credential encryption, four dispersed CHECK POINTs across the codebase. The HMAC signature now also covers the new grace-warning persistence flag, so it can't be tampered with on disk.

A one-shot, transparent v2→v3 storage migration is in place: existing licensed users will simply have their signature silently re-signed on first launch of v0.3.2 — no re-activation required.

Downloads

Platform	Download
macOS (Universal — Intel + Apple Silicon)	.dmg
Windows x64	.exe · .msi
Windows ARM64 (Snapdragon, Surface Pro X)	.exe · .msi
Linux x64	.AppImage · .deb · .rpm
Linux ARM64 (Raspberry Pi, ARM servers)	.AppImage · .deb · .rpm

Installation Notes

macOS

• Download the .dmg, open it, and drag S3 Explorer to Applications
• On first launch, the app is signed with Apple Developer ID — should open without warning

Windows

• Recommended: .exe setup (NSIS installer, supports auto-update)
• Enterprise / managed deployment: .msi (Group Policy / SCCM compatible)

Linux

• Debian / Ubuntu / derivatives: sudo dpkg -i S3.Explorer_*.deb
• Fedora / RHEL / openSUSE: sudo rpm -i S3.Explorer-*.rpm
• Other distros: .AppImage is portable — chmod +x and run

Full source-level changelog

View full commit history on GitHub

S3 Explorer — manage S3-compatible object storage from your desktop

Cross-platform Tauri + Vue 3 client supporting AWS S3, MinIO, Backblaze B2, Cloudflare R2, and 17+ other S3-compatible providers.

Downloads

Platform	Download
Windows x64	.exe · .msi
Windows ARM64 (Snapdragon, Surface Pro X)	.exe · .msi
Linux x64	.AppImage · .deb · .rpm
Linux ARM64 (Raspberry Pi, ARM servers)	.AppImage · .deb · .rpm

Installation Notes

macOS

• Download the .dmg, open it, and drag S3 Explorer to Applications
• On first launch, the app is signed with Apple Developer ID — should open without warning

Windows

• Recommended: .exe setup (NSIS installer, supports auto-update)
• Enterprise / managed deployment: .msi (Group Policy / SCCM compatible)

Linux

• Debian / Ubuntu / derivatives: sudo dpkg -i S3.Explorer_*.deb
• Fedora / RHEL / openSUSE: sudo rpm -i S3.Explorer-*.rpm
• Other distros: .AppImage is portable — chmod +x and run

Changelog

See the full changelog on the source repo.

S3 Explorer — manage S3-compatible object storage from your desktop

Cross-platform Tauri + Vue 3 client supporting AWS S3, MinIO, Backblaze B2, Cloudflare R2, and 17+ other S3-compatible providers.

Downloads

Platform	Download
Windows x64	.exe · .msi
Windows ARM64 (Snapdragon, Surface Pro X)	.exe · .msi
Linux x64	.AppImage · .deb · .rpm
Linux ARM64 (Raspberry Pi, ARM servers)	.AppImage · .deb · .rpm

Installation Notes

macOS

• Download the .dmg, open it, and drag S3 Explorer to Applications
• On first launch, the app is signed with Apple Developer ID — should open without warning

Windows

• Recommended: .exe setup (NSIS installer, supports auto-update)
• Enterprise / managed deployment: .msi (Group Policy / SCCM compatible)

Linux

• Debian / Ubuntu / derivatives: sudo dpkg -i S3.Explorer_*.deb
• Fedora / RHEL / openSUSE: sudo rpm -i S3.Explorer-*.rpm
• Other distros: .AppImage is portable — chmod +x and run

Changelog

See the full changelog on the source repo.

Download the installer for your platform below.

See changelog for details.

Download the installer for your platform below.

See changelog for details.

Download the installer for your platform below.

See changelog for details.