Free File Sharing PHP Script — WeTransfer Alternative

SendZip is a WeTransfer-style file transfer tool that lives in a single PHP file. Upload a file, get a share link, and the link self-destructs after a set time or download count. It ships with a full admin panel (transfer list, delete, disk usage, brute-force protected login) and needs no database, no Composer, and no external services — you can FTP it to a $2/month shared host and it just works.

Files are stored under random names, can never execute on the server, and are streamed back only through the script itself. Expired transfers clean themselves up on every page load, so there is no cron job to configure.

1. Upload sendzip.php to your web space (e.g. public_html/send/).
2. Open it in your browser once — it creates and locks down its storage folder automatically.
3. Open sendzip.php?a=admin, use the built-in generator to create your admin password hash, and paste the generated line into the CONFIG block at the top of the file.
Optional: raise upload_max_filesize / post_max_size in php.ini for large files, and adjust MAX_FILE_MB / RETENTION_HOURS in the CONFIG block.

Paste this prompt into Claude to build this exact product:

Build a complete, production-quality single-file PHP application called SendZip: a WeTransfer-style file transfer tool I can self-host on cheap shared hosting.

Core flow: visitor uploads one file, gets a share link; the recipient opens the link, sees file name / size / expiry, and downloads. Links self-destruct after a configurable number of hours and optionally after N downloads.

Hard requirements:

- One PHP file, PHP 8.1+, no database (JSON metadata files), no Composer, no external services.

- A CONFIG block of constants at the top: DEMO_MODE, MAX_FILE_MB, RETENTION_HOURS, MAX_DOWNLOADS_DEFAULT, ADMIN_PASSWORD_HASH, APP_NAME.

- Security: store uploads under random 32-hex names with a .bin extension in a storage folder the script creates and locks down (.htaccess: deny all + php engine off). Never serve files directly — stream them through the script with Content-Disposition: attachment and X-Content-Type-Options: nosniff. Expired/burned transfers are purged lazily on every request (no cron). CSRF tokens on all forms.

- Admin panel at ?a=admin: session login against a password_hash, sleep(1) on wrong password, KPI cards (active transfers, disk used, retention, max size), a table of transfers (name, size, downloads, expiry, uploader IP) with per-row delete. First run: if no hash is configured, show a one-time password-hash generator that outputs the exact CONFIG line to paste.

- Demo mode: when DEMO_MODE is true, the UI renders fully but uploads and admin login return a friendly "download and self-host" message, and a banner shows at the top.

- UI: clean, modern, dependency-free CSS in the file: CSS custom properties, dark-mode via prefers-color-scheme, drag-and-drop upload zone with file-name preview, copy-to-clipboard button on the share link.

- Handle PHP upload errors explicitly (upload_max_filesize etc.) with human error messages.

Also write a README.md: requirements table, 3-step install, config reference, php.ini notes for large files, an Nginx deny rule (the .htaccess covers Apache), the security design, and an honest "what this is not" section (no virus scanning, no E2E encryption, not a public file host).

What happened when we ran it: Claude (claude-fable-5) produced the complete file in one pass. Syntax check and the functional tests passed on the first attempt. Your result will differ slightly on every run — that's normal; the spec above pins the behavior, not the exact code.

Note: the download on this page ships with DEMO_MODE = false — no demo restrictions. The prompt is for reproducing (or remixing) the build yourself with your own Claude subscription.