upload from a script

Send the file with a PUT to its name. The answer is plain text with its links:

curl -T photo.png https://files.zqpvr.net/

page:    https://files.zqpvr.net/Ab3dEf6hIj9k
direct:  https://files.zqpvr.net/Ab3dEf6hIj9k/photo.png
delete:  https://files.zqpvr.net/Ab3dEf6hIj9k?delete=…
kept:    until 2026-11-12 21:00 UTC

Options go in headers:

X-Keep

1h, 1d (the default), 7d or 30d

X-Burn

1 deletes the file once it has been opened (whoever opens it first has it for 15 minutes)

X-Password

an access password; the file then only opens on its page, after the password

curl -T notes.txt -H "X-Keep: 7d" -H "X-Password: hunter2" https://files.zqpvr.net/

Ask for Accept: application/json to get the same as JSON: id, name, size, expires (Unix time, or null), page, raw, direct and delete_page.

delete

curl -X POST -d key=THE_DELETE_KEY https://files.zqpvr.net/Ab3dEf6hIj9k/delete

The delete key is the part after ?delete= in the delete link.

links

/<id>

the file's page, with a preview and the tags chat apps use to show pictures and videos inline

/<id>/<name>

the file itself, to open or embed anywhere

…?download=1

the same, saved instead of shown

Videos get a thumbnail, and a copy browsers and chat apps can play inline at any size: H.264, VP9 and AV1 keep their own quality and are at most repackaged into MP4 or WebM; anything else (HEVC, old formats, above 4K) becomes H.264. The page and its tags use them once they are ready.

limits

Up to 1 GB a file and 30 days. From one address: 10 uploads an hour and 3 GB a day. Big uploads from the pages go in 8 MB pieces and resume after a dropped connection; a single PUT has to finish in one go.

pastes

Pastes at paste.zqpvr.net are encrypted in the browser (AES-256-GCM; the key is only in the link after #), so they are made on the page rather than with a plain request. A script can do the same: encrypt, then POST {"blob": {"v": 1, "ct", "iv", "salt", "pw"}, "keep", "burn"} to https://paste.zqpvr.net/api/, all base64url, the key derived with PBKDF2-SHA-256 (200,000 rounds) from the 32 random key bytes followed by the password.