send a file. get a link. it deletes itself.
The desktop app and the ShareX endpoint both talk to the same API this page does. Same limits, same links, same self-deleting files.
Drag a file onto the window or the tray icon and the link lands on your clipboard. It updates itself when a new version ships.
Every page on this site as a scriptable command: upload, download, list, quota, stats. Built in C, no runtime to install.
One-request uploader for screenshots and clips. Import the config below, then set zhuzhbox as the destination for images, text and files.
loading…
Bigger than 95 MiB? Use the drop page — it chunks.
No keys, no accounts, no signing. Uploads are chunked so no single request is ever large. Every example below assumes the API host is in your shell:
export ZZ=…
Three calls per file. Chunks may be sent in any order and retried individually; each one is written straight to its offset on disk, so nothing is reassembled at the end.
1 POST /v1/upload/init → token, chunkSize, totalChunks, deleteToken 2 PUT /v1/upload/:token/chunk/0 → repeat for every chunk PUT /v1/upload/:token/chunk/1 … 3 POST /v1/upload/:token/complete → url
A bundle wraps the same three calls: open a collection first, pass its token to each init, seal it at the end.
Reserves a token and an upload session. Counts against the rate limit (20 per 15 minutes) unless it names a collection.
curl -X POST $ZZ/v1/upload/init \ -H 'content-type: application/json' \ -d '{"filename":"clip.mp4","size":734003200,"mimeType":"video/mp4"}' { "token": "aB3kd9Xq2m", "chunkSize": 20971520, "totalChunks": 35, "deleteToken": "…" }
413 if the file is over 25 GiB · 429 if you are over the weekly quota · 503 if the server is at upload capacity
curl -X PUT $ZZ/v1/upload/aB3kd9Xq2m/chunk/0 \ --data-binary @part-0 { "receivedChunks": 1, "totalChunks": 35 }
Turns the session into a record and hands back the public link. 409 if chunks are still missing.
curl -X POST $ZZ/v1/upload/aB3kd9Xq2m/complete { "token": "aB3kd9Xq2m", "url": "https://zhuzhbox.fun/d/aB3kd9Xq2m", "filename": "clip.mp4", "size": 734003200, "expiresAt": "2026-08-27T12:04:31.000Z", "deleteToken": "…" }
Which chunks arrived. Use it to pick up an interrupted upload without starting over. Sessions are dropped after 3 hours of silence.
{ "totalChunks": 35, "chunkSize": 20971520, "size": 734003200,
"receivedChunks": [0, 1, 2, 5] }A bundle is a named list of files that share one link and one expiry. Up to 200 files.
curl -X POST $ZZ/v1/upload/collection/init \ -H 'content-type: application/json' \ -d '{"title":"Trip photos","description":"raw, unsorted"}' { "token": "Kd83nfMq0p", "deleteToken": "…", "expiresAt": "…" }
Closes the list and returns the bundle with its members. After this no more files can join.
curl -X POST $ZZ/v1/sharex \ -H 'X-Filename: shot.png' \ --data-binary @shot.png { "url": "https://zhuzhbox.fun/d/aB3kd9Xq2m?inline=1", … }
Metadata only — name, size, type, expiry. For a bundle, the member list too. 404 once it is gone.
Send the delete token you got at init. Works on a finished file, on a bundle (which takes its members with it), and on an upload still in flight.
curl -X DELETE $ZZ/v1/upload/aB3kd9Xq2m \ -H 'X-Delete-Token: …' 204 No Content
Give it tokens you already hold, get back the ones that still resolve. Up to 500 at a time. This is how the drop page prunes its own list without the server keeping one.
curl -X POST $ZZ/v1/uploads/exists \ -H 'content-type: application/json' \ -d '{"tokens":["aB3kd9Xq2m","Kd83nfMq0p"]}' { "existing": ["aB3kd9Xq2m"] }
Totals across everything live, plus free disk and a per-day breakdown. This is what the stats page draws.
Where you stand in the rolling 30 GiB / 7 day window, keyed on a salted hash of your address. It reflects nobody but the caller.
{ "usedBytes": 4509715200, "limitBytes": 32212254720,
"remainingBytes": 27702539520, "windowDays": 7 }{ "status": "ok", "uptimeSeconds": 862400 }Takes a zhuzhbox link and an optional note. The link is checked against live records, so dead links cannot flood the queue. 10 per 15 minutes.
curl -X POST $ZZ/v1/reports \
-H 'content-type: application/json' \
-d '{"link":"https://zhuzhbox.fun/d/aB3kd9Xq2m","note":"…"}'Counted across every file that has not expired yet. Nothing here is tied to a person — there is nothing stored that could be.
Short version: no account, no logging you can be found by, and everything erases itself on a clock you can read.
| Per file | 25 GiB |
|---|---|
| Per week, per uploader | 30 GiB |
| Files in a bundle | 200 |
| One-shot upload (ShareX, curl) | 95 MiB |
| New uploads | 20 per 15 min |
Bigger files cost more disk, so they're kept for less time. Files in a bundle follow the bundle's own clock instead, so a bundle never loses a member early — and quota frees up as your files expire.
Paste the zhuzhbox link. Reports are anonymous; a sentence about what is wrong is enough to triage it.
No. There is no sign-up, no email field, and no session. The link is the only thing that proves an upload is yours.
A salted one-way hash of your address, used for the weekly quota and for rate limiting. It is not reversible and it is not attached to the file's record in any readable way. No ads, no analytics, no third-party scripts on this page.
Not from the database or the disk alone. Each file is encrypted with a key derived from its own token plus a server-side secret; the token is never stored, only a hash of it. Filenames and types are encrypted the same way. Without the link, a copy of the database is unreadable.
The exception is deliberate and worth naming: when someone reports a link, that report keeps the token so an admin can open the file and judge it. Nothing else escrows a token.
Anything illegal where the server lives, anything sexual involving minors, malware, and using the service to harass someone. Reported uploads are reviewed and removed; uploaders can be blocked.
Either it was reported and removed, or the delete token was used. Files are never moved to a bin — deletion erases the bytes and the record together.
For an upload made somewhere else. Both values came back when it was created.