Hoistbay: An Open-Source S3 and CloudFront Desktop Management Tool
Hoistbay is a free MIT open-source desktop tool that automates S3 uploads and CloudFront cache management.
Hoistbay is an MIT open-source desktop app for macOS and Windows that offers free management of AWS S3 and CloudFront. It lets you predefine header rules like Cache-Control and Content-Type by file pattern and applies them automatically on upload. It also supports whole-folder downloads, one-click CloudFront invalidation, and instant AWS account switching. Keys are stored in the OS keychain, with no backend or telemetry. Its scope is limited to S3 and CloudFront.
Why Developers Need Better S3 Management Tools
For developers who work with AWS regularly, S3 and CloudFront are unavoidable infrastructure, but day-to-day operations are full of repetitive work. Every file upload requires manually setting Cache-Control and Content-Type, clearing the CloudFront cache means clicking through multiple layers in the console, and switching between different accounts is even more cumbersome. Although there are many S3 clients on the market, most are either paid products, bloated with features, or store keys on their own servers, which is worrying.
Hoistbay reached No. 4 on Product Hunt for the day with 105 votes, focusing on the pain point of "automating repetitive work." It is a macOS and Windows desktop application, open source under the MIT license, and completely free.
Core Features: Configure Once, Apply Continuously
Hoistbay's most practical design is "header rules." You can predefine rules for Cache-Control, Content-Type, Content-Encoding, and more based on file patterns, and every subsequent upload will automatically apply them, eliminating the need to manually set them repeatedly. For static sites or CDN acceleration scenarios that require fine-grained control over caching policies, this feature can save a lot of verification time.
In addition to rule automation, it also supports downloading entire folders, one-click CloudFront cache invalidation, and instant switching between AWS accounts. These operations often require multiple navigations in the AWS console, but completing them with one click in a desktop app makes the difference in experience quite obvious.
Cache-Control is the core field in HTTP response headers that controls caching behavior. Common directives include max-age (the maximum time a resource can be cached, in seconds), no-cache (must be validated with the origin server before each use), and no-store (no caching allowed). For static sites, a common practice is to set a long max-age (such as one year) with immutable for resources with hash fingerprints, while setting a short cache or no cache for HTML entry files, balancing load speed and publishing immediacy.
Content-Type declares the MIME type of a resource (such as text/css, image/webp), and the browser uses it to decide how to parse the response. If it is missing or set incorrectly during upload, styles may not take effect, images may fail to render, or scripts may be refused execution. Content-Encoding is used to declare whether a resource is compressed (such as gzip, br) and must match the actual uploaded content; otherwise, client-side decoding will fail. Together, these three determine how CDN edge nodes and browsers cache and process files, which is exactly the key that header rules automate.
CloudFront cache invalidation means making CDN edge nodes discard cached old objects in advance so that the next request fetches the latest version from the origin. CloudFront submits invalidation requests by path wildcard by default (such as /* or /assets/*). Each request is billed and has concurrency limits, so for high-frequency publishing, it is more recommended to use file names with content hashes together with long caching rather than frequent full invalidation. Understanding this makes it clear why the "one-click cache invalidation" button, although convenient, should still be used in combination with a reasonable caching strategy to avoid offsetting the acceleration effect of the CDN.
Security and Privacy: Keys Stay Local Only
Hoistbay makes a clear commitment in its security design: AWS keys are stored in the operating system's keychain, there is no backend server, and no telemetry data is reported. This means your credentials never pass through a third party, and data flow is fully controllable. For teams with compliance requirements or sensitivity to supply chain security, the combination of open source and local storage is more transparent than most commercial clients.
The MIT license also means you can audit the code, modify it yourself, or even build and distribute it internally, without worrying about vendor lock-in or future charges.
The operating system keychain is system-level encrypted credential storage provided by macOS Keychain and Windows Credential Manager. The operating system handles encryption and access control, and applications can only read and write through permission-constrained APIs. Compared with writing keys in plaintext to configuration files or an application's own database, the keychain reduces the risk of keys being directly read by other processes or malware. However, it is not a panacea: once the local account is compromised, an attacker may still be able to call the keychain as the current user. Therefore, combining it with least-privilege IAM users and regular rotation of access keys is the complete credential security practice.
Who It's For, and Its Limitations
This tool is clearly aimed at developers and small teams already familiar with AWS, especially those who frequently manage static resources and maintain multiple environments or multiple client accounts. Its value lies not in having a broad and comprehensive feature set, but in smoothing out the most frequent operations.
However, it should also be viewed objectively: Hoistbay currently only covers S3 and CloudFront. If you need broader cloud storage support, or rely on enterprise-level features such as team collaboration and permission management, it may not be sufficient. As a newly released open-source project, its long-term maintenance activity also remains to be seen.
Conclusion
Hoistbay's approach is clear: encapsulate the most tedious operations in the AWS console in a desktop app, and eliminate trust concerns with open source and local keys. For developers who work with S3 every day, this is a lightweight tool worth trying.
One-line Summary
Hoistbay is a free, MIT open-source desktop tool that automates S3 uploads and CloudFront cache management.
Paragraph Summary
Hoistbay is an MIT open-source desktop application that gained attention on Product Hunt, supports macOS and Windows, and provides free management of AWS S3 and CloudFront. Targeting repetitive work in developers' daily operations, it offers predefined header rules such as Cache-Control and Content-Type by file pattern that are automatically applied on upload. It also supports downloading entire folders, one-click CloudFront cache invalidation, and instant switching between AWS accounts. On security, AWS keys are stored in the operating system keychain, with no backend server, no telemetry, and auditable code. The article notes that it suits developers who frequently manage static resources and multi-account environments, but its features only cover S3 and CloudFront, lack enterprise collaboration capabilities, and its long-term maintenance activity remains to be seen.
Related articles
world2vec: Building Mechanistic World Models with Latent Dynamics Learning
world2vec proposes a reward-free method for learning mechanistic world models via latent dynamics, faithfully reproducing systems over long horizons with at least an order of magnitude fewer parameters than DreamerV3, TD-MPC2, and LeWM, and achieving accurate system identification on 71 attractor benchmarks.
A New KL-DRO Paradigm: Adaptive Scenario Generation Around a Learned Density Model
KL-DRO research proposes centering the KL ball on a learned density model instead of the empirical distribution, with adaptive scenario generation guiding sampling toward the worst case. Experiments show lower cost under distribution shift when records are scarce and the model can extrapolate, with comparable in-distribution cost.
ODE Samplers for Discrete Diffusion Models: Exponential Residual Flows Accelerate Generation
Discrete diffusion models lack deterministic ODE sampling? This article introduces Exponential Residual Flows (ERFs), which introduce continuous residual variables per token to construct piecewise ODEs for deterministic sampling and support consistency distillation acceleration. Superior to prior methods on code and text generation tasks.