Copyparty can put a browser upload page in front of a folder you already use. Before sharing its address, decide who should read that folder and who should change it. The README says running without arguments gives everyone read/write access to the current folder. The supplied sandbox results establish repository setup and test outcomes; they do not establish safe public access.
Existing folders become browser-accessible volumes
Copyparty maps local filesystem folders to URL volumes with permissions and options. That suits administrators who want browser access while keeping files in paths other software already uses. Its browser supports resumable transfers, and its documented protocols include WebDAV, SFTP, FTP and TFTP.
Choose the protocols your clients need, then verify access through each one. The supplied evidence includes a specific reason to check SFTP separately from the browser interface.
What happened when we ran it
The supplied sandbox run checked out Copyparty commit 8b4593c on October 15, 2026. Installation succeeded in 25 seconds, recording 54 dependencies and 83 MB on disk. The build succeeded in 2 seconds. Pytest passed all 31 tests in 25 seconds, with 0 failures. Pip-audit reported 0 known vulnerabilities.
The recorded configuration had 3 CPUs, 8g RAM and the image label ghcr.io/astral-sh/uv:python3.12-bookworm. That label does not independently establish the runtime or operating-system version. The checkout contained 483 files, approximately 102344 source lines and 5.4 MB before installation. The scan recorded a tests directory, 0 CI workflow files and no Dockerfile. The README links Docker material, so this scan does not establish an absence of container support.
These results cover installation, the build and the recorded test suite. They provide no transfer-throughput benchmark or evidence about concurrent uploads, hostile-file isolation, public proxy configuration or enforcement across every optional protocol. The package audit does not certify those deployment choices.
Check anonymous access before sharing the address
The README explicitly warns that a launch without arguments grants everyone read/write access to the current folder. Start a trial with an expendable directory. For a lasting service, define the volumes and account permissions before making it reachable by other people.
Check what an anonymous visitor can list, download and upload, then check the named accounts you intend to use. These are recommended deployment checks; this review did not execute them. If a proxy sits in front of Copyparty, follow the project's client-IP guidance so the service receives the intended visitor address.
SFTP has an open report about disabling moves
The supplied GitHub snapshot includes owner-filed issue #1674, titled "sftp doesn't care about --no-mv". It was open in that snapshot. The report concerns the move-disabling option; it does not establish that all SFTP permissions fail.
This review did not reproduce the report, and the supplied issue text does not establish its behavior at commit 8b4593c specifically. If preventing moves through SFTP is a requirement, verify that behavior on the revision you intend to deploy before relying on the option.
Avoid SMB over a WAN
The README labels SMB unsafe, slow and unsuitable for WAN use. Avoid Copyparty for an internet-facing SMB requirement. This review did not test SMB.
Compare alternatives against the storage requirement
Dufs supports file uploads, access control and WebDAV. Consider it when those capabilities cover your requirements. The supplied measurements contain no Dufs run, so they do not establish that it installs faster or needs less configuration.
SFTPGo supports local and cloud storage backends, including S3-compatible storage. Consider it when those storage integrations drive the decision. Its README identifies the source license as AGPL-3.0-only with additional terms and separately restricts the bundled WebAdmin and WebClient UI theme. Copyparty's repository metadata identifies an MIT license. Review those terms alongside the technical requirements; this review did not test SFTPGo.
Keep the tested commit separate from the release
The supplied release record identifies v1.20.26, published October 14, 2026. Its release page identifies commit 7ccebb6; the sandbox tested commit 8b4593c. The measurements therefore belong to the tested commit and should not be presented as a run of the release tag.
The release notes mention improved shadowing on Windows and macOS in v1.20.25 and corrected false-positive shadowing warnings in v1.20.26. They also point readers to a new warning in the README's xvol section. The supplied readable README extracts do not include that warning, so this review cannot assess its scope.
Use Copyparty when browser access to existing folders fits the job and you can configure and verify the access rules. Before adoption, check anonymous access and the operations allowed through every enabled protocol. If SFTP move restrictions are essential, resolve that requirement before deployment.