About & Help

Droply hosts any common file format and gives you three kinds of links: a shareable page, a direct download and an inline media URL. Storage is a private Telegram channel; the database only keeps metadata.

Supported formats

Formats marked with a tooltip “inline preview supported” can be rendered by `/i/…` links.
image	AVIFBMPGIFICOJPEGJPGPNGSVGWEBP
video	3GPAVIM4VMKVMOVMP4MPEGMPGWEBM
audio	AACAIFFFLACM4AMIDIMP3OGAOGGOPUSWAVWAVE
document	CSVDOCDOCXMARKDOWNMDODSODTPDFPPTPPTXRTFTXTXLSXLSX
archive	7ZBZ2GZRARTARTGZZIP
code	CCPPCSSGOHHTMHTMLJAVAJSJSONJSXLOGMJSPYRSSHSQLTOMLTSTSXXMLYAMLYML
other	BINDAT

Actual limits

File size

Configured maximum: 20 MB per file, up to 10 files per request.

The public Telegram Bot API can upload 50 MB but only download 20 MB, so the effective limit is capped at 20 MB. Run a Local Bot API Server to raise it to 2 GB.

Retention

Files persist until you delete them or an owner-set expiry passes. There is no artificial age limit, but Telegram may remove content that violates its terms.

Rate limits

60 uploads per hour and 120 API requests per minute per client IP (per process).

What we do not claim

No malware scanning — there is no scanner configured.
No guaranteed uptime or permanent availability.
No Google indexing guarantee; file pages are noindex unless the owner opts in.

API

`POST /api/uploads`	Multipart upload. Field `file` (repeatable). Optional fields: `password`, `expiresInDays`, `visibility`, `discoverable`, `maxDownloads`.
`GET /api/files/:code`	Safe metadata (owner sees storage details).
`GET /api/files/:code/download`	Redirects to the direct download endpoint.
`GET /api/files/:code/image`	Redirects to the inline media endpoint.
`GET /api/files/:code/raw`	UTF-8 text preview for text formats only.
`PATCH /api/files/:code`	Owner token required. Update `visibility`, `discoverable`, `expiresInDays`.
`DELETE /api/files/:code`	Owner token or admin token via `X-Droply-Token` header.
`POST /api/files/:code/unlock`	Password unlock; sets a scoped cookie.
`POST /api/files/:code/report`	Report abuse.
`GET /api/health`	Health and configuration summary (no secrets).
`/l/:code`	File page.
`/d/:code`	Direct download bytes.
`/i/:code`	Inline media bytes for safe formats.

All example URLs are built from https://droply.knightltd.cyou and the real database record.

FAQ

Why is my large video rejected?

The public Telegram Bot API only allows downloads up to 20 MB, so Droply refuses anything larger rather than accepting a file it could never serve back. Use a Local Bot API Server or an external object storage provider for bigger files.

Can I embed an HTML page I uploaded?

No. HTML, SVG and script-like files are always served as plain-text attachments and are never rendered on the main origin, which prevents stored-XSS and content spoofing.

How do I delete my file?

Keep the owner token shown after upload (it is also stored in your browser for the session). Use the Owner controls panel on the file page, or call DELETE /api/files/:code with the X-Droply-Token header.

Are links guessable?

Codes are 5 cryptographically random characters from a 62-character alphabet with a database uniqueness constraint — about 916 million combinations. Files are unlisted by default and excluded from the sitemap.

Can I protect a file with a password?

Yes. Send a password field with the upload. Unlocking sets an HttpOnly cookie scoped to that file. Owner tokens still work independently.