GhostDrop v1.5 expands the service with faster sharing workflows, richer upload controls, improved API support, and broader client compatibility.
This file is password protected. Enter the password to download.
https://api.ghostdrop.qzz.io · No account auth · Passwords protect individual resources · CORS open
Returns the server information about the server such as the amount of files present the uptime the ram and cpu usage
Creates a text paste and returns a shareable link. Paste data is stored as UTF-8 text. A custom slug can be used instead of the generated six-character ID.
| field | type | required | description |
|---|---|---|---|
| data | string | yes | text content to store |
| slug | string | no | custom ID with letters, numbers, hyphens, or underscores |
| password | string | no | optional password; stored server-side as a hash |
Returns the HTML paste viewer. Unprotected pastes display immediately. Password-protected pastes show a password form and load their contents after authentication.
Returns the raw UTF-8 paste contents. Password-protected pastes require the X-Paste-Password header. A password can also be supplied as the password query parameter, although the header is recommended because query strings may be logged.
Accepts multipart/form-data with a single file field. Returns a short file ID (either a 6-character random string or your custom slug) and expiry metadata.
Warning: API file uploads are limited to ~4.5 MB. Larger files will be rejected.
| field | type | required | description |
|---|---|---|---|
| file | file | yes | the file to upload |
| slug | form | no | custom identifier (2+ chars, only letters/numbers/hyphens/underscores). Must not be a reserved slug (see below). |
| password | form | no | optional file password for protected downloads |
| duration | form | no | retention length from 1 to 12 hours, 1 to 6 days, or 1 to 3 weeks (defaults to 6 hours) |
| duration_unit | form | no | hours, days, or weeks |
Reserved slugs — these cannot be used: upload, download, delete, health, files, metadata, api, admin, static, assets, public, docs, openapi, redoc, www, root, system, config, help, status
Downloads a file by ID (either a custom slug or a short random string). Serves the original filename. If the file is password protected, send the password header or the API returns 401. If expired, deletes and returns 410.
| param | in | description |
|---|---|---|
| file_id | path | the ID or slug returned from POST /upload/ |
| password | header | required only for protected files |
Fetches metadata for an uploaded file by ID (slug or random string). Returns the original filename, expiry timestamp, current view count, and whether a password is required.
| param | in | description |
|---|---|---|
| file_id | path | the ID or slug from POST /upload/ |
Self-hosted only. This endpoint is not available on the public GhostDrop instance. It only works on your own deployment.
Deletes an uploaded file and its metadata by ID. If the file is password protected, the correct password must be sent as a header.
| param | in | description |
|---|---|---|
| file_id | path | the ID or slug from POST /upload/ |
| password | header | required only for protected files |
Point your camera at a GhostDrop QR code. Only links from link.ghostdrop.qzz.io will open. Anything else is treated as invalid.
All notable changes after v1.2 are listed here in reverse chronological order.
Custom upload identifiers, password-protected files, Docker support, and a rebuilt download page.
1c7de9e … HEAD
install.ps1) and Android APK support.GHOSTDROP_DEBUG_UI) — developer panel with real-time frontend event logging.Form().Desktop navigation ergonomics update.
5657138
Sharing improvements and mobile download fix.
90ff0f1 3a056e2
Upload flow hardening and search indexing setup.
b7b8d80 0b06897
sitemap.xml and robots.txt support for search indexing and crawler control.These Terms apply to GhostDrop, the GhostDrop website and API, the GhostClient Windows uploader, GhostBot for Discord, and related share pages or integrations. By using any of them, you agree to these Terms.
If you do not agree to these Terms, do not access or use GhostDrop or its related tools. If you use GhostBot on behalf of a Discord server, team, or organization, you represent that you are authorized to do so.
GhostDrop is a lightweight file-sharing service that accepts uploads, assigns file IDs or custom slugs, and makes files available for a limited time. In the default configuration, files are intended to expire automatically after about 6 hours. GhostClient can upload local files from Windows and copy share links to your clipboard. GhostBot can upload Discord attachments to GhostDrop, fetch GhostDrop metadata, and send GhostDrop files back into Discord.
Your use of these tools may also be subject to the terms, privacy notices, and technical controls of third-party services and platforms, including Discord, GitHub, hosting providers, analytics providers, QR code providers, and your operating system. Running GhostClient may download an executable and register a Windows context-menu entry. Using GhostBot requires a Discord bot integration and remains subject to Discord's platform rules.
You retain responsibility for any file, text, password, slug, or other material you submit. You represent that you have the necessary rights and permissions to upload, transfer, or share that content, including where it contains personal data, confidential information, or third-party intellectual property.
You may not use GhostDrop, GhostClient, or GhostBot to upload, distribute, request, automate, or facilitate:
GhostDrop links function like bearer links: anyone with the link may be able to reach the file. Password protection, where supported, adds another layer but is not a guarantee of secrecy. Do not treat GhostDrop as a backup service, long-term archive, or a suitable place for extremely sensitive data without your own safeguards.
We may change, rate-limit, suspend, or discontinue any part of GhostDrop, GhostClient, GhostBot, or related endpoints at any time. Files may expire earlier than expected, integrations may fail, and features may differ across clients or deployments.
We may delete content, disable links, block access, revoke integrations, or investigate misuse at any time to address abuse, legal requests, security incidents, platform-policy concerns, or operational needs.
GhostDrop and related tools are provided "as is" and "as available" without warranties of any kind, express or implied, including any warranty of availability, fitness for a particular purpose, confidentiality, or non-infringement.
To the maximum extent permitted by law, GhostDrop and its operators will not be liable for any indirect, incidental, special, consequential, or punitive damages, or for any loss of data, profits, business, goodwill, or access arising from or related to use of the service or tools.
We may update these Terms from time to time. The version posted here is the current version. Questions about these Terms can be directed to the project repository or project contact channels listed there.
Last updated: May 24, 2026 · GhostDrop Terms of ServiceGhostDrop is designed to collect as little as practical, but GhostDrop and its related tools still process files, metadata, technical logs, and some third-party platform data to operate uploads, downloads, sharing, and integrations.
This Privacy Policy covers the GhostDrop website and API, the GhostClient Windows uploader, GhostBot for Discord, and related share pages or integrations that link to this policy.
When you upload a file, GhostDrop stores the file contents under a short file ID or custom slug together with metadata such as the original filename, file size, expiry timestamp, view count, and whether password protection is enabled. In the default configuration, uploaded files and their metadata are intended to be automatically deleted after about 6 hours, or sooner if removed.
When password protection is accepted by the GhostDrop API, the service stores a derived Argon2 password hash so later download requests can be verified. The plaintext password is not intended to be retained by the core service after upload, although it may still pass through the client, bot, browser, operating system, or network stack that you use.
The public website may set a small functional cookie, such as to remember dismissed release notes. The landing page also currently loads Google Analytics, which may collect standard analytics data such as page views, device or browser information, and related telemetry under Google's policies. If you use camera-based QR scanning, NFC, clipboard, or native share features, your browser or device may request those permissions and process data locally to perform the requested action.
GhostClient reads the file you choose on your Windows device, uploads that file and its filename to GhostDrop, fetches the current API base URL from the GhostDrop GitHub repository, and copies the resulting share link to your clipboard. Its installer downloads an executable to your local app-data directory and writes per-user Windows registry entries to add a context-menu action.
GhostBot processes slash-command inputs, Discord attachment metadata, Discord-hosted file URLs, and the files or metadata needed to complete commands such as /drop, /peek, /health, and /get. When you use /drop, the bot fetches the attachment from Discord and uploads it to GhostDrop. When you use /get, the bot downloads a GhostDrop file and re-sends it into Discord. Some responses are marked ephemeral in Discord, but Discord still processes the interaction under its own policies.
Depending on how you use GhostDrop, information may also be processed by third parties such as Discord, GitHub, Google Analytics, QR-code providers, your hosting provider, CDN, reverse proxy, or operating system. For example, the share popup can request a QR image from api.qrserver.com, which receives the file link embedded in that QR request.
Files may be reachable by anyone who has the valid file link or ID. If a file is password protected, the password is intended to be required before download. Treat file links, IDs, slugs, and passwords as sensitive secrets, and assume that anything you deliberately send through Discord or other third-party services is also subject to those services' processing.
The service may generate standard HTTP and application logs during normal operation, which can include IP addresses, request paths, response status codes, timestamps, user-agent details, and operational error data. Log retention depends on deployment, hosting, reverse-proxy, and infrastructure settings.
GhostDrop file retention is intended to be temporary, but logs, analytics records, Discord-side data, GitHub-side requests, and other third-party records may persist longer according to the policies and infrastructure of those services.
Password hashes are designed to reduce exposure of stored passwords, but files are not encrypted at rest in the default GhostDrop configuration. Transport security, access control, hosting isolation, and log retention depend on your deployment and third-party infrastructure. Do not rely on GhostDrop or its related tools as your only safeguard for highly sensitive information.
GhostDrop, GhostClient, and GhostBot are not directed to children under 13, and we do not knowingly design these tools to solicit data from children.
We may update this policy at any time. The current version is always available here.
Questions about this policy can be directed to the project repository.
Last updated: May 24, 2026 · GhostDrop Privacy Policy