Why does macOS show a warning the first time I open Hoistbay?

The app is not notarized by Apple yet. Unzip, move Hoistbay to Applications, then right-click the app and choose Open. If you only see 'Move to Trash', go to System Settings → Privacy & Security and click Open Anyway. You only need to do this once.

Can I use temporary AWS credentials?

Yes. Session tokens work for temporary credentials, and bucket regions are detected automatically to avoid SignatureDoesNotMatch errors.

How does it handle network failures during uploads?

Network hiccups are retried automatically up to 3 times, and anything that still fails is reported per object instead of failing silently.

Hoistbay — Manage S3 and CloudFront without the AWS console

Hoistbay is a free, open-source desktop app for macOS and Windows that manages Amazon S3 buckets and CloudFront distributions without the AWS console. It focuses on deploy workflows: uploading build folders with correct Cache-Control headers, invalidating CloudFront caches, and switching between AWS accounts. Credentials are stored in the OS keychain, and the app communicates only with AWS — no backend, no telemetry.

Key Features

Per-bucket Cache-Control rules

Set rules once per bucket (e.g. *.js and *.css get Cache-Control: max-age=31536000, *.html gets no-cache) and they are applied automatically to every upload.

Local-only credential storage

Access keys are encrypted at rest via flutter_secure_storage, using macOS Keychain or Windows Credential Manager. No account, no backend, no telemetry.

Multi-account and multi-region profiles

Save a profile per AWS account and region, switch instantly, and use session tokens for temporary credentials. Bucket regions are detected automatically.

Uploads, downloads, and bulk operations

Drag in files or multiple folders with structure preserved; download single objects or whole folders; multi-select to rename, move, copy across buckets and regions, or delete, folders included.

CloudFront cache invalidation

See distributions next to buckets, invalidate /* or specific paths after a deploy, and watch the invalidation progress until completion.

Metadata inspection and in-place fixes

View object properties, HTTP headers, tags, and versions in a details pane, and edit Content-Type, Content-Encoding, or x-amz-meta-* values without re-uploading.

Unified Activity panel

Uploads, downloads, deletes, and cache clears show live progress with start/finish times and per-item success or failure status.

S3 edge-case handling

Custom Signature V4 signing handles keys with spaces or special characters; bulk deletes send the required Content-MD5; folders with 1,000+ objects are fully paginated.

How It Works

Connect your AWS credentials

Store access keys in your OS keychain (macOS Keychain or Windows Credential Manager); the app reads them only when calling AWS and saves profiles per account and region.

Deploy builds to S3

Drag build folders into the app; per-bucket header rules apply the right Cache-Control headers automatically, with automatic retries (up to 3 times) on network failures.

Clear CloudFront cache

Select a distribution, invalidate /* or specific paths after a deploy, and watch the invalidation until it reports 'Cache cleared'.

Pros & Cons

Pros

Free and open source under the MIT license, with a public GitHub repository and documented least-privilege IAM permissions
Strong security posture: keys stay in the OS keychain, there is no backend, no analytics, and the app only talks to official AWS endpoints over HTTPS
Purpose-built for deploy workflows rather than generic S3 browsing — header rules, cache invalidation, and account switching are first-class
Handles known S3 pain points (keys with special characters, Content-MD5 on bulk deletes, 1,000+ object pagination) out of the box
Runs entirely on your desktop with no account required, and can be built from source with Flutter

Cons

Who It's For

Best for

Developers and small teams who deploy static sites or apps to S3 + CloudFront and repeat the same upload-and-invalidate steps every release
Users managing multiple AWS accounts and regions who want fast switching from a desktop app
Security-conscious users who want their AWS keys stored locally in the OS keychain and an auditable, MIT-licensed codebase with no backend o

Not ideal for

Teams needing a Linux desktop client today (it is coming soon)
Users looking for a broad AWS console replacement beyond S3 and CloudFront
Enterprises that require vendor support, SLAs, or signed/notarized installers out of the box

Use Cases

Uploading web build folders to S3 with correct Cache-Control headers for hashed assets and no-cache HTML

Invalidating CloudFront distributions after a deployment

Managing multiple AWS accounts (prod, staging, dev) and regions from one desktop app

Inspecting and fixing object metadata, headers, tags, and versions without re-uploading

Auditing and verifying an S3 tool's security posture via its open-source code and documented IAM permissions

FAQ

Is Hoistbay free?

Yes. Hoistbay is free and open source under the MIT license, available for macOS and Windows, and can also be built from source with Flutter.

Where are my AWS credentials stored?

Access keys are encrypted at rest using flutter_secure_storage, which uses the native macOS Keychain or Windows Credential Manager. Keys are only read when the app calls AWS.

Does Hoistbay send my data or keys to a third-party server?

No. There is no backend and no telemetry — the app talks only to official AWS regional endpoints over HTTPS using the aws_s3_api SDK.

Which platforms does Hoistbay support?

macOS (Apple Silicon and Intel, macOS 12+) and Windows 10/11 x64. A Linux client is listed as coming soon.

Hoistbay