Cyberduck, S3 Browser or Transmit? Choosing an S3 file browser for a business team

The three desktop apps at a glance

Prices and platforms below are from each vendor's site as of October 2026.

• Cyberduck: macOS and Windows. Free and donation-supported, also sold in the Mac App Store and the Windows store. Signs in with access keys, an AWS profile, IAM Identity Center or temporary STS credentials.
• S3 Browser, now called CS Browser: Windows only. Free for personal use only; Pro costs $49.99 per computer for business use. Signs in with access keys, AssumeRole, IAM Identity Center or credentials files.
• Transmit 5: macOS 13 or later only. $45 after a 7-day trial. Signs in with an IAM user's access key ID and secret, optionally with an AWS profile or an IAM role on top.

Cyberduck

Cyberduck is open source under the GPL and runs on both macOS and Windows. It speaks many protocols besides S3, which makes it a favourite for people who also manage FTP, SFTP or other cloud storage.

For S3 it supports the full range of AWS sign-in options: long-term access keys, profiles from the AWS credentials file, IAM Identity Center, and temporary credentials from STS with optional MFA. That flexibility is a strength for engineers. For a business user it means someone has to give them one of those identities and set it up on their machine.

S3 Browser, now CS Browser

The long-running Windows client from s3browser.com is now called CS Browser. It is Windows only. The free edition is licensed for personal use only, so a business needs Pro, which costs $49.99 per computer with a lifetime license and one year of upgrades.

It has good support for AWS access patterns, including AssumeRole with an external ID and IAM Identity Center. As with Cyberduck, each person still connects as their own AWS identity.

Transmit 5

Transmit from Panic is a polished file transfer app for the Mac. It handles FTP, SFTP, WebDAV and S3, including S3 Signature Version 4 and AWS GovCloud.

Connections use an IAM user's access key ID and secret, optionally with an AWS profile or an IAM role on top. It costs $45 after a 7-day trial and requires macOS 13 or later, so it is not an option for Windows users.

What all three have in common

These are installed applications that act as an AWS client on someone's computer. That design is exactly right for technical users. For a business team it raises the same four questions every time.

None of this is a flaw in the apps. It is what an S3 client is for.

• Every person needs an AWS identity: an IAM user with access keys, an IAM Identity Center assignment, or a role they can assume. Someone has to create it, scope it and remove it when they leave.
• Permissions live in IAM. "Legal can see the contracts folder but not finance" becomes an IAM or bucket policy that an engineer writes and maintains.
• Every computer needs the app. Mixed Mac and Windows teams end up with two tools, and a contractor on a locked-down laptop may not be able to install either.
• Opening a file means downloading it. Office documents, PDFs and iPhone HEIC photos open in whatever the computer has installed, after the download finishes.

When a browser workspace fits better

BucketDesk takes the other approach. Your files stay in your S3 bucket, and BucketDesk reaches them through one scoped IAM role in your AWS account, created with a guided CloudFormation setup and protected by an external ID. Your staff never get AWS credentials at all. They sign in to BucketDesk.

The trade-off runs the other way too. BucketDesk is not a bulk transfer tool. If an engineer needs to move a terabyte between buckets or script transfers, Cyberduck, CS Browser or the AWS CLI is the better choice.

How to access Amazon S3 files without the AWS consoleSecure AWS access with IAM roles and external IDs

• Roles instead of IAM users: admins, operators and viewers are managed in the workspace, and viewers are free on paid plans.
• Nothing to install: it runs in the browser on Mac, Windows and anything else.
• Preview before download: PDF, images including HEIC, and text open in the browser on every plan; Word, Excel, PowerPoint, audio and video on Pro and Business.
• Sharing without scripts: share a file or folder with a link that expires and can be revoked, instead of generating presigned URLs.
• Files stay where they are: nothing is copied or migrated, and if you stop using BucketDesk the files are exactly where they were.

How to choose

Many teams end up with both: engineers keep their desktop client, and everyone else uses the workspace on the same buckets.

• One technical person with occasional transfers: Cyberduck on Mac or Windows, or Transmit on a Mac.
• A Windows team that already manages IAM well: CS Browser Pro, with AssumeRole or IAM Identity Center rather than long-term keys.
• Non-technical staff who need to find, preview and share files: a workspace, so nobody outside engineering needs an AWS identity.