Furman includes a full-featured S3 client that works with any S3-compatible storage — AWS, MinIO, Backblaze B2, Cloudflare R2, DigitalOcean Spaces, Wasabi, and dozens more.
Press Cmd+S to open the Connection Manager. You can authenticate using:
- AWS profile — uses profiles from
~/.aws/credentials - Access key / secret key — stored securely in the system keychain
- Default credentials — uses the default AWS credential chain
- IAM role assumption — assume a role via STS with configurable external ID and session duration
- OIDC / Web Identity Federation — authenticate via an identity provider (Okta, Auth0, Entra ID, Keycloak, etc.) and assume an IAM role with
AssumeRoleWithWebIdentity - Anonymous access — browse public buckets without any credentials
Furman ships with a built-in database of 38 S3-compatible providers (sourced from Cyberduck) with 179 regional endpoints. When you select a provider, the endpoint and region are auto-filled and provider-specific capabilities are configured automatically.
Saved connections appear in the sidebar for quick access with provider icons. Press Cmd+S again while connected to disconnect.
To authenticate via an identity provider:
- Check "Sign in with Identity Provider (OIDC)" in the connection dialog
- Enter the Issuer URL (e.g.
https://login.example.com), Client ID, and optionally Scopes (default:openid) - Enter the Role ARN of the IAM role to assume and set a Session Duration
- Click Authenticate — a browser window opens for login, then Furman exchanges the token with AWS STS
Saved profiles with OIDC attempt a silent token refresh on reconnect. If the refresh token has expired, the edit dialog opens for re-authentication.
Enterprise users behind corporate firewalls can route S3 connections through an HTTP/HTTPS proxy. Configure in the Security tab of the connection form:
- Manual — enter a proxy URL (e.g.
http://proxy.example.com:8080) with optional username and password for basic authentication - System — auto-detect proxy from
HTTP_PROXY/HTTPS_PROXY/NO_PROXYenvironment variables
Proxy settings are per-connection. The proxy password is stored separately in the system keychain.
For AWS S3 buckets with Transfer Acceleration enabled, check the Transfer Acceleration option in the Security tab of the connection form to use accelerated endpoints for faster uploads and downloads.
- Browse buckets and objects with standard dual-pane navigation
- Create folders and rename objects
- Create and delete buckets (from the bucket list in the connection dialog, Cmd+S)
- Search objects by name within a bucket (Cmd+F)
- Quick filter works the same as local panels — just start typing
- Download (S3 → local) and upload (local → S3) with drag-and-drop or Copy/Move commands
- S3-to-S3 copy between different connections
- S3-to-SFTP and SFTP-to-S3 cross-protocol transfers (via local temp directory)
- Multipart upload for large files with concurrent parts and automatic retries (threshold, part size, and concurrency are configurable)
- Transfer queue with configurable concurrency (1–5 simultaneous transfers)
- Pause / resume with checkpointing — interrupted transfers pick up where they left off
- Transfer speed displayed with smoothed (EMA) calculation
- Bandwidth limiting — throttle transfer speed via Preferences (configurable limit in bytes/sec)
- CRC32C checksum verification — downloads are automatically verified against CRC32C checksums (with MD5/ETag and size fallbacks). On mismatch, the corrupted file is deleted and an error is reported.
- Transfer panel (Cmd+J) — always toggleable to monitor active and completed transfers
Press Cmd+Y to sync between panels. The sync dialog shows a diff view of all changes and lets you select which files to transfer.
- Comparison modes — size/modification time (fast) or ETag/checksum (accurate)
- Exclude patterns — comma-separated glob patterns to skip files (default:
.DS_Store, Thumbs.db, .git/**), persisted across sessions - Bidirectional — sync in either direction between local and S3 panels, including S3 ↔ S3
| Shortcut | Action |
|---|---|
| Cmd+U | Generate presigned URL (copy to clipboard) |
| Cmd+K | Copy S3 URI (s3://bucket/key) to clipboard |
| Cmd+L | Bulk storage class change for selected objects |
| Cmd+I / F9 | Properties (single object) or Batch Edit (multiple objects) |
Change storage class for individual objects (via Properties) or in bulk (Cmd+L). Supported classes: STANDARD, STANDARD_IA, ONEZONE_IA, INTELLIGENT_TIERING, GLACIER, GLACIER_IR, DEEP_ARCHIVE.
Objects in Glacier/Deep Archive storage classes can be restored from the Properties dialog with configurable restore duration and retrieval tier (Standard, Bulk, Expedited).
View, download, restore, or delete individual object versions from the Properties dialog (expandable section).
MFA Delete — when MFA Delete is enabled on a versioned bucket, deleting object versions requires an MFA device token. Furman prompts for the MFA token automatically. MFA Delete can be toggled from the bucket versioning configuration in the General tab of bucket Properties (requires root account credentials and a hardware MFA device).
From the Properties dialog (single object):
- Object metadata — edit Content-Type, Content-Disposition, Cache-Control, Content-Encoding, and custom metadata key-value pairs
- Object tags — edit up to 10 tags per object
- Bucket tags — edit up to 50 tags per bucket
Select multiple objects and press Cmd+I / F9 to open the batch edit dialog:
- Metadata tab — set Content-Type, Content-Disposition, Cache-Control, Content-Encoding, and custom metadata across all selected objects. Only non-empty fields are applied.
- Tags tab — set tags on all selected objects with two modes:
- Replace all — overwrites existing tags with the new set
- Merge with existing — preserves existing tags, new tags override by key (fails if merged count exceeds 10)
- Progress bar with object count, current filename, and Cancel button
- Results summary showing succeeded/failed counts with expandable failed keys list
Furman supports S3 Object Lock for WORM (Write Once Read Many) compliance:
Bucket-level (from bucket Properties):
- Enable/disable Object Lock on the bucket
- Set default retention mode (Governance or Compliance) and period (days or years)
Object-level (from object Properties):
- Retention — set Governance or Compliance retention with a retain-until date. Bypass governance option available for privileged users.
- Legal hold — toggle legal hold ON/OFF per object
- Bulk retention — apply the same retention settings to multiple selected objects at once
Furman can encrypt files on your machine before uploading to S3. This ensures data is encrypted at rest even if you don't trust the storage provider.
- Upload — when encryption is active, each file is encrypted to a temp file with a random salt and nonce, then uploaded with custom S3 metadata (
x-amz-meta-furman-*) that records the encryption parameters - Download — Furman detects the metadata on download and prompts for the decryption password automatically
- Preview / Edit (F3 / F4) — encrypted files are detected and a password prompt appears before the file is downloaded and decrypted
- Per-profile default — in the S3 connection dialog (or when editing a saved profile), check "Client-side encryption by default". Furman will prompt for a password on every upload to that bucket.
- On-demand — when downloading encrypted files, Furman detects the encryption metadata and prompts for the password automatically. No configuration needed.
Files that have been client-side encrypted show a lock icon in the file listing when the cursor passes over them.
When client-side encryption is enabled for a profile, the Encryption tab in the connection form lets you configure:
| Setting | Options | Default |
|---|---|---|
| Cipher | AES-256-GCM, ChaCha20-Poly1305 | AES-256-GCM |
| KDF Memory | 8 MiB, 19 MiB, 64 MiB, 128 MiB | 19 MiB |
| KDF Iterations | 1, 2, 4, 8 | 2 |
| KDF Parallelism | 1, 2, 4 | 1 |
| Auto-encrypt min size | Always, 1 KB, 10 KB, 100 KB, 1 MB | Always |
| Extension filter | Comma-separated list (empty = all) | All files |
| Secure temp cleanup | Overwrite temp files with zeros before deleting | Off |
Higher KDF values make brute-force attacks harder but slow down encryption/decryption. The auto-encrypt threshold skips the password prompt when all selected files are below the given size. Extension filtering only triggers encryption for files matching the listed extensions.
| Parameter | Value |
|---|---|
| Cipher | AES-256-GCM or ChaCha20-Poly1305 (configurable) |
| KDF | Argon2id (configurable memory, time, parallelism) |
| Salt | 16 random bytes per file |
| Nonce | 12 random bytes per file |
Encryption metadata (including algorithm and KDF parameters) is stored as custom S3 object metadata and does not modify the object key or require any server-side support. Files encrypted with different settings can coexist in the same bucket — decryption reads all parameters from the object metadata.
All bucket-level settings are accessible from the Properties dialog when viewing the bucket root (select the bucket entry and press Cmd+I). Settings are organized into tabs.
- Versioning — view status (Enabled/Suspended/Disabled), enable or suspend. Toggle MFA Delete (requires root account and hardware MFA device)
- Server-Side Encryption — view and configure SSE algorithm (AES-256, aws:kms, aws:kms:dsse), KMS key ID (with key picker), bucket key status
- Object Lock — enable Object Lock, set default retention mode and period
- Public Access Block — toggle all 4 settings: block public ACLs, ignore public ACLs, block public policy, restrict public buckets
- Bucket Policy — JSON editor with validation; save or delete policy
- CORS Configuration — add, edit, remove CORS rules with per-rule allowed origins, methods, headers, expose headers, and max age
- ACL — view owner and grants with friendly labels for well-known groups (Everyone, Authenticated Users, Log Delivery). Set canned ACL (private, public-read, etc.)
- Lifecycle Rules — full CRUD for lifecycle rules including current-version transitions, expiration, noncurrent-version transitions/expiration, and abort incomplete multipart upload settings
- Incomplete Uploads — list and abort incomplete multipart uploads (individual or all at once)
Configure S3 Inventory reports (AWS only):
- Add, edit, and delete inventory configurations
- Configure schedule (Daily/Weekly), destination bucket ARN, prefix, and output format (CSV, ORC, Parquet)
- Choose included object versions (Current or All)
- Select optional fields: Size, LastModifiedDate, StorageClass, ETag, IsMultipartUploaded, ReplicationStatus, EncryptionStatus, ObjectLockRetainUntilDate, ObjectLockMode, ObjectLockLegalHoldStatus, IntelligentTieringAccessTier, BucketKeyStatus, ChecksumAlgorithm, ObjectAccessControlList, ObjectOwner
- Filter by key prefix and configure cross-account destination
Configure cross-region or cross-account replication (AWS only):
- Set the IAM Role ARN for the replication service
- Add, edit, and delete replication rules with per-rule settings:
- Priority, status (Enabled/Disabled), filter prefix
- Destination bucket ARN with optional storage class override, account ID, and KMS key
- Delete marker replication toggle
- Save or delete the entire replication configuration
Manage CloudFront CDN distributions associated with the bucket (AWS only):
- List distributions — view ID, domain name, status, enabled state
- Create distribution — configure comment, default root object, price class (US/Canada/Europe, +Asia/Middle East/Africa, or All edge locations), HTTP version, viewer protocol policy, aliases (CNAMEs), and custom error responses
- Edit / toggle / delete distributions
- Cache invalidation — create invalidations with path patterns, view recent invalidation history
- Copy domain — quick clipboard copy of the CloudFront domain name
Configure S3 Event Notifications (AWS only):
- Notification rules — add, edit, and delete rules that send notifications when specific S3 events occur
- Destination types: SNS Topic, SQS Queue, or Lambda Function (specify by ARN)
- Event selection: Object Created (Put, Post, Copy, CompleteMultipartUpload), Object Removed (Delete, DeleteMarkerCreated), Object Restore (Post, Completed, Delete), and others (Replication, Tagging, ACL, Lifecycle, IntelligentTiering)
- Optional key filters: prefix and suffix to limit which objects trigger the notification
- Amazon EventBridge — toggle to send all S3 events to EventBridge for advanced routing and filtering
- Save Configuration — apply all rule changes and EventBridge setting at once
Manage S3 Access Points for fine-grained access control (AWS only):
- List access points — view name, ARN, network origin (Internet/VPC), and VPC ID
- Create access point — specify name (3–255 characters), network origin (Internet or VPC with VPC ID), and Public Access Block settings (all four toggles default to enabled)
- Access point details — view ARN, alias, bucket, network origin, creation date, endpoints, and read-only Public Access Block configuration
- Access point policy — JSON editor with validation; save or delete the access point's resource policy
- Delete access point — remove with confirmation
Access Points use the S3 Control API and require AWS credentials with s3:CreateAccessPoint, s3:GetAccessPoint, s3:DeleteAccessPoint, and related permissions. The AWS account ID is resolved automatically via STS.
Available in the General tab for supported providers:
- Website Hosting — configure bucket as a static website with index document, error document, and redirect rules
- Requester Pays — toggle requester-pays mode where data transfer costs are billed to the requester
- Server Access Logging — enable access logging with target bucket and prefix configuration
- Object Ownership — configure Object Ownership settings (BucketOwnerEnforced, BucketOwnerPreferred, ObjectWriter)
- Bucket Tags — add, edit, remove bucket-level tags (up to 50)
Furman auto-detects provider capabilities and adjusts the UI accordingly — features are conditionally shown based on what the provider supports. You can also override any capability per-connection via the Custom capabilities section in the connection dialog.
If your provider is missing or has incorrect capabilities, please open an issue with the provider name and which capabilities should be enabled or disabled.
| Capability | AWS | MinIO | B2 | R2 | DO | Linode | Wasabi | GCS |
|---|---|---|---|---|---|---|---|---|
| List Buckets | Y | Y | Y | Y | Y | — | Y | Y |
| Versioning | Y | Y | — | — | — | Y | Y | Y |
| Lifecycle Rules | Y | Y | Y | — | Y | Y | — | Y |
| CORS | Y | — | Y | — | Y | Y | — | Y |
| Bucket Policy | Y | Y | — | — | — | — | Y | — |
| ACL | Y | — | — | — | Y | Y | Y | Y |
| Public Access Block | Y | — | — | — | — | — | — | — |
| Server-Side Encryption | Y | Y | — | — | — | — | — | Y |
| Glacier Restore | Y | — | — | — | — | — | — | — |
| Presigned URLs | Y | Y | Y | Y | Y | Y | Y | Y |
| Object Metadata | Y | Y | Y | Y | Y | Y | Y | Y |
| Object Tags | Y | Y | — | — | — | — | Y | — |
| Bucket Tags | Y | Y | — | — | — | — | Y | Y |
| Multipart Cleanup | Y | Y | Y | Y | Y | Y | Y | Y |
| Website Hosting | Y | — | — | — | — | — | — | — |
| Requester Pays | Y | — | — | — | — | — | — | — |
| Object Ownership | Y | — | — | — | — | — | — | — |
| Access Logging | Y | — | — | — | — | — | — | — |
| Object Lock | Y | Y | — | — | — | — | Y | — |
| CloudFront CDN | Y | — | — | — | — | — | — | — |
| Inventory | Y | — | — | — | — | — | — | — |
| Replication | Y | — | — | — | — | — | — | — |
| Event Notifications | Y | — | — | — | — | — | — | — |
| Access Points | Y | — | — | — | — | — | — | — |
| Storage Classes | All | STD | STD | STD | STD | STD | STD | STD, NEARLINE, COLDLINE, ARCHIVE |
Y = supported, — = not supported, STD = STANDARD only, All = STANDARD, STANDARD_IA, ONEZONE_IA, INTELLIGENT_TIERING, GLACIER, GLACIER_IR, DEEP_ARCHIVE
Providers not listed above (imported from the Cyberduck database) default to all capabilities enabled. Use the Custom capabilities UI to disable features that don't work with your provider.