v5.2 . For ASP.NET Core 8+ On ASP.NET Web Forms? Use AjaxUploader ->

Modern file uploads for ASP.NET Core,
built for production.

CoreUpload is a drop-in Tag Helper + Razor component with the new self-hosted Companion broker that keeps cloud tokens server-side, 6 cloud sources (Drive, Dropbox, OneDrive, Box, Unsplash, Companion), headless hooks for React, Vue, Svelte, and Angular, a content-aware image editor with smart-crop, overlays, filters, and AVIF/WebP output, 7 transport strategies (chunked, direct-to-S3, Azure Blob, GCS resumable, tus 1.0, URL import, single POST), AES-GCM encryption-at-rest, offline-mode queueing, and 28 built-in locales (incl. RTL Arabic + Hebrew) - all wired into ASP.NET Core middleware with zero external dependencies on AWS, Azure, or Google SDKs in the core library.

Explore 119 Demos Download Package

7 Transport strategies

28 Built-in locales (incl. RTL)

119 Live demos shipped

0 Required runtime deps

Direct-to-S3 multipart with resume

Transport

Seven upload strategies, one API.

Switch from chunked POST to direct-to-S3 multipart, GCS resumable, or tus 1.0 without rewriting your upload flow. Register your own transport via CoreUpload.registerStrategy().

single

One POST

Traditional multipart/form-data POST. Ideal for small files and simple forms.

chunked

Server-side chunked

Splits file into parts, uploads with parallel concurrency, per-chunk retry with exponential backoff, and server-side assembly.

Direct-to-S3 multipart

Browser uploads each part directly to Amazon S3 (or MinIO, Backblaze B2, Cloudflare R2, Wasabi) via your server-signed presigned URLs. Server never sees the bytes.

azure

Direct-to-Azure Blob

PutBlock + PutBlockList against a pre-signed blob SAS URL. Same pattern as S3 - client does the work, server just signs.

tus

tus 1.0 protocol

Zero-dependency tus 1.0 client with Core + Creation + Termination extensions. Interop with tusd, uppy-companion, and any tus server.

gcs

Direct-to-GCS resumable

Google Cloud Storage resumable upload protocol. Server initiates the session via IGcsSigner; browser PUTs chunks with Content-Range headers. 256 KiB grain auto-aligned. Bytes never traverse Kestrel.

urlImport

Server URL import

Paste a URL; the server fetches and streams through your IUploaderProvider. Client sees live NDJSON progress events during the fetch.

Try it now

A working uploader in 60 seconds.

The uploader on the right is the real component, running on this page - drop a file and watch it go. No sign-up, no API key, no card. On localhost you don't even need a license.

1

Install the package

dotnet add package CoreUpload

Register two lines in `Program.cs`

builder.Services.AddCoreUpload();
app.MapCoreUploadEndpoints();

3

Drop in the Tag Helper

<core-upload asp-upload-url="/api/upload/upload" />

That's the whole integration. Progress, validation, chunking, and resume are on by default.

Live on this page - drop a file

Drag & drop files here, or paste from clipboard

Files land in the demo's temp folder and auto-expire. 50 MB cap on this page.

What's new in 5.2

Headline release

Server-side cloud tokens, headless UI, and a pro image editor.

The Companion broker, two new cloud sources, headless hooks for all four major frameworks, and a content-aware image editor with AVIF/WebP output. All additive - no breaking changes from 5.1.

Headline

Companion broker

A self-hosted Node/Express OAuth and file-proxy broker (multipleupload/server/companion) with zero new dependencies. Provider client secrets and access tokens stay server-side. Built-in Dropbox, Box, Drive, OneDrive; proxy and server-to-destination transfer modes; HMAC-signed OAuth state.

Headless

React . Vue . Svelte . Angular hooks

useUploader() for React and Vue, a use:uploader action for Svelte, and an UploaderService for Angular return files, progress, status, and actions for fully custom UI.

Image editor

Smart-crop + overlays + AVIF/WebP

Content-aware focal-point smart-crop (edge-energy, no ML), draggable text and sticker overlays, filter presets (Mono/Sepia/Warm/Cool/Vivid), EXIF info panel, crop-ratio chips, and AVIF/WebP output with a quality slider. URL transforms honored server-side via a pluggable IImageTransformer.

Cloud sources

6 sources incl. Unsplash + Companion

Drive, Dropbox, OneDrive, Box (now first-class), Unsplash (search and import, no OAuth popup), and the Companion broker. Each adapter resolves with RemoteFile[] handed to the URL-import pipeline with NDJSON live progress.

Compliance

Encryption-at-rest (AES-GCM-256)

PBKDF2 (200k iter), per-file salt + IV. Kestrel only ever sees ciphertext. Decryption recipe in .NET 8 with AesGcm ships in the docs.

Compliance

Pre-upload virus scan

One virusScan hook integrates ClamAV / VirusTotal / Defender. Rejected files never reach storage.

Resilience

Offline-first queueing + SW

Files queue to IndexedDB while offline; uploads auto-resume when the connection returns. Register a Service Worker for background sync.

Image pipeline

HEIC + 5 presets + annotation

iPhone HEIC auto-converts to JPEG. 5 presets bundle resize + crop + auto-orient. Inline 6-tool markup (pen/arrow/rect/text/blur/eraser) before upload.

Composable UI

StatusBar + Informer + multi-tab dashboard

Extractable progress chrome you can mount anywhere on your page. Cross-tab coordination + a "manager tab" can aggregate every tab's uploads.

Drag-to-reorder + keyboard

enableQueueReorder lets users drag pending tasks - Arrow Up/Down for keyboard accessibility (WCAG 2.1). Mobile cameraCapture for direct camera launch.

i18n

28 locales + auto-detect

Locale auto-detect from navigator.language across ~28 locales. Arabic and Hebrew with right-to-left. Pairs with RequestLocalizationOptions for server-side negotiation.

Resilience

Custom retry policy + bandwidth cap

Pluggable retryPolicy for Retry-After / jitter / budgets. maxUploadBytesPerSecond for fair bandwidth use.

Capabilities

Production-grade upload platform.

Not a file-input replacement - an upload toolkit that handles the hard parts so you can focus on your application.

IndexedDB-backed resume

Every in-flight upload persists to IndexedDB. Tab crashes, page reloads, network blips - the resumed task picks up its server session (tus URL, S3 part ETags, chunk offsets) and continues from where it stopped.

Parallel chunks + Web Workers

Configurable chunk concurrency keeps the pipe full. SHA-256 and CRC32 hashing runs off-thread - gigabyte files no longer block the UI, with a CSP-safe main-thread fallback.

Inline image editor

Rotate +/-90 deg, flip H/V, interactive crop with 8 drag handles and optional aspect-ratio lock. Layered on the existing client-side resize, compress, and watermark pipeline.

Every input source

Drag-and-drop, full-page drop overlay, folder traversal, clipboard paste, and server URL import with live NDJSON progress - all through a single API.

Multi-layer validation

Extensions, MIME types with magic-byte sniffing, file sizes, image dimensions, duplicate detection, and custom rules - enforced client-side and re-checked server-side.

Theme-ready, i18n-ready

Default, Bootstrap, Tailwind, and dark-mode themes. CSS variables expose every color + radius + spacing. Every user-facing string localized; register your own locale in one literal.

ASP.NET Core native

Built the Core way.

DI, minimal APIs, Tag Helpers, and IFormFile-compatible streaming. Targets .NET 8 and newer.

DI + Tag Helpers + Razor

services.AddCoreUpload(), app.MapCoreUploadEndpoints(), and <core-upload> Tag Helper. Everything composes with your existing pipeline.

Pluggable providers

IUploaderProvider, IS3Signer, IAzureSigner, IGcsSigner - no AWS, Azure, or Google SDK bundled. Your host plugs in the signer, the library stays dependency-light.

Kestrel & IIS

Run directly on Kestrel or behind IIS reverse proxy. Linux and Windows containers fully supported - no platform-specific workarounds.

Quick start

Tag Helper on a Razor page - you're done.

Register the services, map the endpoints, drop the Tag Helper. Advanced configuration (strategies, resume, image editor) is on the JS instance that the Tag Helper renders.

Program.cs & Page.cshtml

// Program.cs
builder.Services.AddCoreUpload();
// For direct-to-S3 / Azure (no AWS/Azure SDK bundled - provide your own signer)
builder.Services.AddSingleton<IS3Signer, MyS3Signer>();
builder.Services.AddSingleton<IAzureSigner, MyAzureSigner>();

var app = builder.Build();
app.MapCoreUploadEndpoints();

<!-- Page.cshtml -->
<core-upload asp-upload-url="/api/upload/upload"
 asp-extensions=".jpg,.png,.gif,.pdf,.docx"
 asp-max-size="500MB"
 asp-multiple="true"
 asp-auto-upload="true" />

Advanced: direct-to-S3 + IndexedDB resume

// Select the strategy + persistence on the rendered instance
CoreUpload.create('#uploader', {
 uploadUrl: '/api/upload/upload',
 strategy: 's3', // or 'chunked', 'azure', 'tus', 'urlImport' chunkSize: 5 * 1024 * 1024,
 chunkConcurrency: 4,
 persistState: true,
 persistAdapter: 'indexeddb',
 persistBlobs: true // survive tab crashes without re-picking files
});

Install via NuGet: dotnet add package CoreUpload

Uploader family

Same core, every stack.

All three products ship from one canonical JavaScript source with a shared wire protocol. Pick the server flavor for your application.

This site

CoreUpload

Minimal-API endpoints, Tag Helper, and Razor components for .NET 8 and newer.

ASP.NET Web Forms

AjaxUploader ->

Server control with Visual Studio integration and a CuteWebUI 4.x compatibility shim.

Standalone JS

MultipleUpload ->

Zero-dependency npm package for any backend - React, Vue, Node, PHP, Python, static sites.

Why self-hosted

Your files. Your servers. One license.

Upload SaaS bills you for every file and gigabyte, forever, and keeps your data on their cloud. CoreUpload is a one-time license that runs inside your own app - the bytes never leave your infrastructure.

	CoreUploadSelf-hosted component	SaaS upload APIse.g. Uploadcare, Filestack	Roll your ownIFormFile + custom JS
Where your files live	Your own server or storage	The vendor's cloud	Your server
Pricing model	One-time perpetual license	Per-upload + per-GB, monthly	Engineering time
Ongoing usage fees	None	Scale with every upload	Infrastructure only
Data residency & compliance	You control it entirely	Vendor's regions & policies	You control it entirely
Vendor lock-in	None - it runs in your app	High	None
.NET-native (Tag Helper, DI, middleware)		REST API / SDK	Build it yourself
Chunked, resumable, S3, Azure, tus	Built-in	Varies by plan	Build each
Works air-gapped / offline			Depends
Time to first upload	Minutes	Hours	Weeks

Comparison reflects the typical model for each category; SaaS pricing and capabilities vary by vendor and plan.

Modern file uploads for ASP.NET Core,built for production.