If you are looking for a FileBrowser Quantum alternative, first decide whether you still want a web UI over ordinary files or a storage engine that owns encryption, previews, versions, and recovery. FileBrowser Quantum is the active community fork; Cotton is the second kind of product. This is not a scoreboard with fake certainty; it is a product-fit comparison for self-hosted file cloud decisions.
Cotton is the better alternative when the requirement has grown beyond browsing a directory: encryption at rest, optional client-side E2E, resumable large-file uploads, richer previews, expiring shares, snapshots, versions, WebDAV, and native sync clients. It is not a drop-in replacement when other programs must keep reading the same plaintext files directly from disk.
The original FileBrowser moved into maintenance mode. Quantum is the active community fork, adding OIDC, LDAP, 2FA, and other modern features. Both remain web interfaces over an ordinary directory rather than becoming a chunked storage engine with deduplication, encryption, and snapshots like Cotton.
Filebrowser points at a directory and shows the plain files already there - nothing is chunked, deduplicated, or content-addressed. Cotton is the storage layer itself: a content-addressed chunked engine. Filebrowser shows your filesystem; Cotton is one.
Filebrowser stores files as plaintext and closed its at-rest-encryption request as not planned; there is no client-side or end-to-end option in either the original or the Quantum fork. Cotton does streaming AES-GCM by default plus client-side E2E folders.
The original Filebrowser is username and password with no 2FA or passkeys; the Quantum fork adds OIDC, LDAP, and 2FA - credit where due. Filebrowser previews images, text, video, and PDF; Cotton adds audio waveforms, STL/OBJ/3MF 3D, HEIC, mobile PDF text, and video seek on encrypted storage.
Pick FileBrowser Quantum when you already have files in a directory and just want a clean window onto them with near-zero setup and no database - your backups and rsync read those plain files directly. Pick Cotton when you want an engine that encrypts, deduplicates, previews, shares, synchronizes, and recovers.
Cotton does not need to beat every long-established ecosystem on every surface. The useful comparison is narrower: storage behavior, privacy posture, recovery model, deployment shape, and product focus.
Cotton stores file content as chunks and manifests, so deduplication, verification, versions, snapshots, and cleanup share one mental model.
Compression and AES-GCM encryption sit in the normal storage path; the site does not sell isolated crypto speed as user-visible ingest speed.
Snapshots, versions, trash, and reclaim are positioned as ordinary file-cloud workflows, not emergency-only backend chores.
Cotton deliberately stays narrower than broad collaboration suites: files, previews, sharing, WebDAV, recovery, and operator visibility.
Cotton is the cleaner story when files, previews, shares, snapshots, versions, WebDAV, passkeys, admin diagnostics, and a compact Docker/Postgres deployment are the main problem.
People who just want a clean browser over files that stay as plain files on disk.
You want a focused self-hosted file cloud with content-addressed storage, streaming crypto, snapshots, previews, WebDAV, sharing, passkeys, and a compact Docker deployment.
You need a dead-simple web UI over an existing folder, with a tiny footprint and no external database more than the Cotton storage-engine and recovery-model strengths.
Cotton is not trying to be a bigger suite than Filebrowser. It is trying to be the sharper file cloud when the file engine itself is the product decision.
If you want encryption, dedup, rich previews, and recovery, Cotton is the engine, not just a window.
Last reviewed June 2026. Every line below links to its receipt - the actual issue, doc, or commit it came from. Competitors move fast; if a link goes stale, open an issue and we fix it.
Receipts
Not always. Cotton is a focused file cloud, not a clone of every app and integration in the older ecosystems. It fits best when file storage, previews, sharing, snapshots, WebDAV, security, and deployment simplicity are the main problem.
Because people searching for a self-hosted file cloud often start with the familiar names. The comparison makes the tradeoff explicit instead of pretending every product has the same goal.
If you want a dead-simple web UI over an existing folder with a tiny footprint, no external database, and files that stay as plain files your other tools can read, Filebrowser is purpose-built for that. Cotton is the fit when you want an engine that encrypts, deduplicates, previews, and recovers.
Cotton is a strong alternative when you need a managed storage engine with encryption at rest, optional client-side E2E folders, large-file uploads, richer previews, expiring shares, snapshots, versions, WebDAV, and native sync clients. Stay with FileBrowser Quantum when the priority is a tiny web UI over ordinary files that other tools can read directly.
FileBrowser Quantum is the active community fork of the original FileBrowser. It adds modern features such as OIDC, LDAP, and 2FA while keeping the same basic category: a web interface over an ordinary directory rather than a separate chunked storage engine.
Yes. The official Docker guide provides a Compose setup using the stable image, a persistent data-directory mount, and one or more mounted source directories. That keeps FileBrowser Quantum lightweight and close to the host filesystem. Cotton also uses Docker, but adds Postgres because it manages encrypted chunks, versions, snapshots, and deduplication rather than exposing ordinary files directly.
The official quick-try container starts with admin / admin. That pair is only suitable for a local trial. For a persistent deployment, set FILEBROWSER_ADMIN_PASSWORD before the first startup and replace any default credential before exposing the service to a network.
Yes. FileBrowser Quantum supports TOTP for password-authenticated users. The operator supplies a FILEBROWSER_TOTP_SECRET, users enroll from Profile > Security, and enforcedOtp can require enrollment for password users. OIDC and proxy authentication follow their external identity provider instead. Cotton provides both TOTP and passkeys natively.