How the explorer works
Does the explorer see or store my access key?
No. Your browser holds the key, signs each S3 request itself, and talks straight to the bucket endpoint. The secret you enter here is never sent to Storm, and Storm is never in the path of a read or write.
Where does my secret live in my browser?
You choose, per bucket, and the default is the most private: this tab only, held in session storage and gone when the tab closes. You can instead remember it in this browser profile, or keep it encrypted at rest, AES-256-GCM behind a passphrase only you know. Forgetting a connection deletes its secret with it.
Can Storm read my files?
Your key never reaches Storm's servers, so nothing you do here passes through Storm. If you host your data on Storm Buckets, Storm's operators have root on the node, like any host, so the honest claim is auditability, not zero-knowledge. If you need protection from that too, encrypt your files before you upload them.
What permissions does my key need?
Read-only is enough to browse, search, preview, and download. If you are pasting a key into a web page, paste the one that can only read. Upload and delete work when the key allows them; the first denied write greys that control and everything else keeps working.
Why does my bucket need a CORS rule?
Storm buckets do not need one; browser access works out of the box. An external bucket has to allow this site's origin, because your browser talks to it directly and there is deliberately no Storm proxy in the middle. Add a CORS rule on the bucket that permits https://stormdevelopments.ca to make browser requests. Every provider has a place for this (AWS and Garage via the S3 CORS config, Backblaze B2 in its bucket CORS settings); the exact form is in your provider's docs.
What happens with a really large bucket?
Nothing dramatic: it never lists the whole bucket. Listings load one folder at a time, 1,000 objects a page, behind an explicit load-more. Folder sizes are counted only on demand and stop at 100,000 objects, shown with a +. Search covers the folders you have loaded; open a folder to search deeper.
Will browsing run up my egress bill?
Not by accident. Egress safety mode is on by default for external buckets: previews wait for a tap instead of loading on select, and you see the file's size before fetching a byte. Downloads stream straight from your endpoint to your disk with no middleman doubling the transfer. On Storm buckets it defaults off, because flat pricing means a preview cannot cost you money. The toggle sits in the browser's toolbar, per bucket.
Do I have to use Storm to use it?
No. We test it against Garage (the engine under Storm Buckets), AWS S3, and Backblaze B2. Anything else that speaks S3 and allows browser access should work the same: path-style and virtual-host addressing are both supported. "No lock-in" is only real if the tool works on storage that is not ours, so it does. Storm Buckets hosts S3 in Canada; we just do not trap you in it.
What can't it do?
Uploads are a single PUT per file, no multipart and no resume, so very large files are better sent with rclone or the AWS CLI. Zip downloads are assembled in browser memory and warn past 2 GB. Images preview inline up to 10 MB; bigger ones are download-only. A connection browses one existing bucket: it does not create buckets or manage keys on external endpoints. Listings are cached until you refresh, so changes made by other tools appear on the next refresh.