The safe, secure and completely free way to transfer large files around the Web.

What is ZendTo?

It is a classic problem: you need to send files to someone, or they need to send them to you, and there's no way except email. But they are too large or your administrator won't let you transfer the files by email at all. ZendTo to the rescue!

Why ZendTo?

ZendTo is a completely free web-based system, which you can run on your own server with complete safety and security. It runs from any Linux / Unix server or virtualisation system, there is no size limit and it will send files 50% faster than by email.

Key Features

• Secure encryption & decryption of uploaded files, using a user-selected passphrase, to protect personal or restricted data
• Checksums of uploaded files, to avoid disputes over exactly what content was delivered
• Single-use download links
• Users are informed of the use and processing of their data, in line with GDPR requirements
• Very simple to use, supports drag-and-drop file selection
• Easy to translate into other languages (14 provided), and customise for your organisation
• Large files are uploaded in small chunks, to work around network security device limits
• Integrates with any existing Active Directory, OAuth, SAML-based, LDAP or IMAP authentication service
• No hard upload limits (50GB uploads are normal)
• Automated installer provided for quick installation on any minimal server install of Rocky, RedHat, Ubuntu, Debian, CentOS, SUSE, OpenSUSE or FreeBSD
• Docker support for very fast deployment
• Scriptable and can be driven via a simple API
• Integrates with existing customer service ticketing systems

Technical support is provided by email or an active mailing list. All completely free.

News

• 12/11/2024 - Released beta version 6.14-3 with updated dependencies, and SMTP OAuth2 support courtesy of Ben Westover. Please see the beta page for more info and download links. Also the ChangeLog.
• 04/09/2023 - Released beta version 6.14-2 with updated dependencies, and new beta of SimpleSAMLphp for ZendTo 1.2-1 with an updated version of SimpleSAMLphp in it. Please see the beta page for more info and download links. Also the ChangeLog.
• 07/12/2022 - Released production version 6.13-3 to fix problem where people using the legacy mail sending (those not setting 'SMTPserver') could get wrapped headers on some versions of PHP.
• 01/11/2022 - Released production version 6.13-2 to fix a problem where the "Download All Files as a Zip" button was broken on systems running PHP 7. Thanks to Cory Musil for the fix!
• 28/10/2022 - New Production release: Version 6.13-1. All libraries and dependencies upgraded to their latest versions, Docker support, Installer improved, plus various bug fixes. Please see the Change Log for more details and the downloads page to get it.
• 26/10/2022 - ZendTo Installer updated to support RedHat 9, Rocky 9 and Ubuntu 22.
• 25/10/2022 - Released beta version 6.12-12 to update all dependencies and libraries to latest available versions.
• 16/06/2022 - Released beta version 6.12-10 which fixes a Docker permissions error.
• 14/06/2022 - Released beta version 6.12-9 which includes Smarty 4.1 which properly supports PHP 8.1.
• 09/06/2022 - Docker support is now documented here. Please do try it out!
• 06/06/2022 - Docker support! Finally. Included in the distribution is a docker-compose.yml which you can use to build a single container service ZendTo on port 80 with shared storage. Add your own nginx to add https on the front. New beta release 6.12-7 available from the beta page. ZendTo itself is stable, I don't guarantee the Docker support to be perfect yet. Please let me know if you try it.
• 04/04/2022 - New beta release 6.12-1 available from the beta page. I've updated all ZendTo dependencies to the latest versions (including the zendto-saml package) and got it all working on PHP 8.0 and 8.1. Also I have updated the Installer to support Rocky Linux, and Ubuntu 21. Sorry it's been so long for this update to arrive, life has been busy. Please do test this, and the updated Installer, and let me know what you think.
• 28/06/2021 - New Production release 6.11-2. This is an important security release as it fixes a vulnerability in the naming of uploaded files done using a specially crafted HTTP POST request. "Requests for Drop-offs" are shown in a user's Inbox, and there have been various logging improvements and other bug fixes. For more details, please see the Change Log.
• 18/06/2021 - New beta release 6.10-10 available from the beta page. The same error improvements are now also applied to new drop-offs. Requests shown in a user's Inbox and the global list of all drop-offs (highlighted in yellow) are now sorted correctly by their creation date, not their start date.
• 11/06/2021 - New beta release 6.10-9 available from the beta page. This significantly improves the handling of errors in requests sent to multiple recipients.
• 04/06/2021 - New beta release 6.10-8 available from the beta page. This should finally fix the timezone problems with requests for drop-offs, where users west of the server could receive a request email that they couldn't use yet.
• 24/05/2021 - New beta release 6.10-6 available from the beta page. Added new "check_templates" tool which is run by the upgrade script, to verify your template files are up to date. Also a big security fix in the handling of uploaded filenames.
• 07/05/2021 - Installer fixed to avoid the "I am not a robot" problem.
• 23/04/2021 - Google "I am not a robot" not appearing? Here is how to fix it!
• 26/03/2021 - New beta release 6.10-4 available from the beta page. The AD authenticator can now read results from the AD server that are split over multiple pages. Please also note the new settings that "upgrade" will show you! If you use 'authLDAPMemberRole' to restrict logins by group, you will need to setup the new AD-specific versions of this setting.
• 14/03/2021 - New production release 6.09-1. The biggest new feature this time is "single-use links", where you can make a drop-off whose files can each only be downloaded once. If the recipient needs another attempt, the sender just clicks the "Resend Dropoff" button via their Outbox. For more details, please see the Change Log.
• 08/03/2021 - Screenshots updated to reflect latest new features.
• 08/03/2021 - Another new beta release 6.08-15 is now available from the beta page. Emailed links no longer include any email addresses, improving data privacy without affecting functionality. Hopefully now getting (very?) close to a production release.
• 04/03/2021 - Another new beta release 6.08-13 is now available from the beta page. Lots of bugs fixed. Hopefully now getting close to a production release.
• 03/03/2021 - New beta release 6.08-11 is now available from the beta page. Valid unused "requests" are now shown in your "Inbox" page, and the admin's Global List page, giving you the ability to see their info, and delete or resend each one.
• 26/02/2021 - New beta release 6.08-8 is now available from the beta page. If you are using the 'AD' authenticator, your Inbox will now show all drop-offs addressed to any of your "proxyAddresses", as well as those to your main email address.
• 25/02/2021 - New beta release 6.08-7 is now available from the beta page. In the "new drop-off" form you can now specify a precise expiry time for the drop-off using a date/time picker, as well as just being able to set the number of days until expiry. You can disable the expiry changer from appearing, in your preferences.php file.
• 22/02/2021 - New beta release 6.08-5 now available from the beta page. The main new feature is the introduction of "one-time links" so that senders can restrict the recipient to only being able to download each file once. The status of the files in the drop-off can easily be reset by the sender clicking the "Resend Dropoff" button in their ZendTo Outbox.
• 02/02/2021 - New Production release 6.07-1. This includes all the bug-fixes from the 6.06 beta releases.
• 10/12/2020 - New beta release 6.06-3. Some minor bug fixes, plus a fix where requests would get the wrong start+expiry times if requested from a different timezone from the server. Also changed the behaviour of RPM upgrades to make systems simply work after upgrading, when any of the *.tpl user-interface template files had been changed locally.
• 04/11/2020 - New beta release 6.06-2. 2 minor bug fixes, as listed at the top of the beta page. As soon as I hear confirmation that this release works, I will do a full "production" release. So the more of you test it for me, the faster you can get those pesky bugs fixed on your production systems.
• 28/09/2020 - New beta release 6.06-1. The "autorequest" automation script should now work correctly again, and offer all the available options it can. Also I have extended the length of database fields that contained organization names to 255 characters, instead of 32. As usual, your DB schema should automatically update itself on installation.
• 31/08/2020 - New Production release 6.05-4. The main improvements are to the "request a drop-off" page, which I have overhauled. You can now specify an opening and closing time and date for the resulting drop-off. So if people try to submit too late or too early, they can't. Also a bunch of minor improvements and bug-fixes. The Change Log will tell you more.
• 13/08/2020 - Another new beta release 6.04-2. A few logging improvements and logging bug fixes that have been requested, and more detailed logging about users creating new drop-offs. The Change Log should tell you more.
• 22/07/2020 - New beta release 6.04-1. I have overhauled the "request a drop-off" page and added date/time pickers to it to set precise start and end times when the request is valid.
• 15/07/2020 - Bug-fix Production release 6.03-5. All known bugs fixed, including one that could cause users to be reminded about the wrong near-expiry drop-offs. Also updated translations. See the Change Log for details.
• 10/07/2020 - Bug-fix Production release 6.03-4. Fixed reported bugs in the chunk upload error handling code.
• 05/07/2020 - New Production release 6.03-3. New Turkish translation, some bug-fixes and speed optimisation to template library.
• 30/06/2020 - New Production release 6.03-1. New features include editable Subject lines, Inbox/Outbox "Export as CSV" buttons and others; and also some bug-fixes.
• 29/06/2020 - Released a new bug-fix beta 6.02-5. This fixes a bug where totally incorrect expiry times were shown in reminder emails. Thanks to Susoczki Attila for reporting this. Download instructions are on the beta page.
• 25/06/2020 - Released a new beta 6.02-4. Exporting as CSV will now only export the visible columns, and you can make all the columns visible with 1 click. This is very close to a production release, so please check the pages look okay on all browsers! More info on the beta page and in the Change Log.
• 21/06/2020 - Released a new beta 6.02-2. You can now export as CSV your Inbox, Outbox (and the list of all drop-offs if you're an admin). Also all of those pages now have a means to toggle the visibility of each column.
• 19/06/2020 - Released a new beta 6.02-1. The main addition is that users can now edit the "Subject" line used when telling recipients about the new drop-off. More details are on the beta page and in the Change Log.
• 09/06/2020 - Released ZendTo 6.01-2. If, for any reason, the passphrase cannot be read when creating a new drop-off in response to a request, the new drop-off is now rejected immediately.
• 05/06/2020 - Released ZendTo 6.01-1. This allows you to change which columns are visible in the global list of all drop-offs. Also "autolist" has been improved to be able to handle much larger numbers of drop-offs.
• 04/06/2020 - Released ZendTo 6.0-2. This is a bug-fix release, no new features.
• 02/06/2020 - Released zendto-saml version 1.00. See the SAML documentation for instructions on how to use this.
• 31/05/2020 - Released new version 6.00.
  The big features in this release are:
  • Login via OAuth, Yubikeys etc with SAML-based authentication
  • Uploaded files are sent in small chunks with auto-retries
  • Users can reduce the lifetime of a drop-off
  • Recipients can be made to read a legal waiver before downloading files
  plus many other new features and fixes which are listed in the Change Log.