MinIO Client GUI for macOS, Windows and Linux

MinIO's own answer is a web console and a command line

MinIO gives you S3 semantics on hardware you control, which is why it ends up holding CI artifacts, backups, datasets and anything that is not allowed to leave the building. The tooling it ships with is a browser console and mc, the command-line client. Both are good. Neither is a file manager that sits next to the rest of your storage on your own desktop.

That is the gap AnyStorage fills: point it at a MinIO endpoint and buckets open as folders on macOS, Windows or Linux, with uploads, downloads, renames, deletes and presigned links in the same window as your other connections.

The facts below were checked on MinIO's documentation in September 2026. One note on that documentation, because it moves: it now lives on docs.min.io under the AIStor branding, with the open-source object store under the community/minio-object-store path.

The port, and the other port

MinIO's server reference states that with --address omitted the process "binds to port 9000 on all configured IPv4 addresses, IPv6 addresses, and hostnames on the host machine". So http://HOST:9000 is the S3 API endpoint unless somebody changed it.

The console is the part people get wrong. The docs say MinIO "by default, selects a random port for the Console UI on each server startup", and an explicit port comes from --console-address or MINIO_CONSOLE_ADDRESS. The documented example is ./minio server /mnt/data --console-address ":9001", which is why 9001 is the number everyone quotes — a convention from the docs, not a default. A client belongs on 9000; 9001 is a browser UI and will not answer S3 calls.

Four fields, and the switch that decides everything

An mc alias and a desktop connection hold the same information. MinIO documents the alias as "the name to associate to the S3-compatible service", created with mc alias set ALIAS URL ACCESSKEY SECRETKEY — and notes the secret key needs a minimum of 8 characters and that --api defaults to S3v4, with "AWS Signature V2 considered deprecated by AWS".

# What mc stores as an alias
mc alias set myminio http://192.168.1.10:9000 minioadmin minioadmin

# The same four values in AnyStorage: add a connection,
# choose S3-compatible, then fill in
#   endpoint     http://192.168.1.10:9000
#   access key   minioadmin
#   secret key   minioadmin
#   path-style   on

Path-style is not optional. MinIO's core settings documentation is explicit about MINIO_DOMAIN: it "enables Virtual Host-style requests to the MinIO AIStor deployment", and "omitting this setting directs MinIO AIStor to only accept the default path-style requests". Unless the administrator configured a domain, bucket.host/key is refused and host/bucket/key is the only thing that works. A client that defaults to virtual-hosted addressing — which is correct for Amazon S3 — produces DNS failures or signature errors against a plain MinIO install, and neither message says "turn on path-style". This is the mirror image of Cloudflare R2, which accepts both styles.

The region is a guess you have to match. MinIO documents MINIO_SITE_REGION (with mc admin config set ALIAS site region="us-east-1" as the example) and describes it as being used for site replication configurations; it publishes no universal default value. Because the region is part of the SigV4 credential scope, a value that disagrees with the server surfaces as a signature error rather than a region error. Leave the field empty or use us-east-1, and if the operator set a region, copy that string exactly. Our SignatureDoesNotMatch with MinIO page walks through the rest.

TLS, and what a self-signed certificate costs you

MinIO reads PEM-encoded public.crt and private.key from $HOME/.minio/certs by default, or from --certs-dir, and the documentation says it supports "self-signed, internal or private certificate authorities (CAs), [and] third-party CAs". Trust is directory-based: CA files go in the CAs/ subdirectory, and "MinIO AIStor reads all top-level files in the CAs/ directory and adds valid X.509 PEM certificates to the trusted root CA pool".

The errors on the client side are worth memorising, because MinIO's own TLS troubleshooting page lists them: x509: certificate signed by unknown authority, x509: certificate has expired or is not yet valid, x509: certificate is valid for X, not Y, and tls: bad certificate.

For mc, the escape hatch is documented and discouraged: --insecure, or MC_INSECURE=true, meaning "disable SSL certificate verification" — testing only. The durable fix MinIO recommends is to issue node certificates from a CA and place that CA in the CAs/ directory instead of replacing self-signed certificates forever. For a desktop client the same logic applies one level up: import that CA into the machine's own trust store, which is what desktop applications consult, and the https:// endpoint starts working everywhere at once.

Versioning, object lock and encryption, from a client's seat

These are server-side settings, but they change what a GUI appears to do.

• Versioning is per bucket and can be suspended. A DELETE without a version ID "creates a 0-byte DeleteMarker as the latest version of that object" — the object disappears from the listing and still occupies space. Permanent removal means deleting a specific version ID.
• Object locking requires versioning: "bucket versioning is a prerequisite for configuring object locking and retention rules." MinIO's docs note you "must enable object locking during bucket creation as per S3 behavior", with one recent exception — since release RELEASE.2025-05-20T20-30-00Z a default retention rule can be set on an existing bucket with mc retention set --default.
• Retention modes decide who can win an argument with the storage. GOVERNANCE lets a user holding s3:BypassGovernanceRetention modify locked objects; COMPLIANCE prevents all users, including root, until the period expires. Legal hold is indefinite and separate.
• Encryption: SSE-KMS and SSE-S3 need an external key manager, and SSE-C "requires a TLS/HTTPS-enabled deployment" because the client sends the key in request headers.

The practical reading: if a delete in any client leaves the object visible in a version listing, that is versioning working correctly. If a delete fails outright, check for a retention rule before blaming the app — in COMPLIANCE mode no client can override it.

How the MinIO tools compare

Read it as trade-offs, not a ranking:

• The console is the right place to manage the deployment — users, policies, replication, retention — one deployment per tab, on a port that may be random.
• mc wins anything scriptable: mc mirror, mc rm --recursive, cron, CI. It is also the tool to reach for when a GUI's error message is too polite to be useful.
• Cyberduck is a solid free browser for MinIO over the S3 protocol, with no mount and no Linux build. rclone is the most capable and the least convenient, and rclone mount costs a FUSE or WinFsp install plus a --vfs-cache-mode decision.
• AnyStorage is the file-manager layer: several MinIO servers open at once alongside cloud buckets, with an optional mount that needs no driver.

Connecting from macOS, Windows and Linux

Version 0.2.25 shipped on 23 September 2026 for macOS 11 and later, Windows 10 and later, and Ubuntu 20.04 and later, so the same connection works from every machine that can reach the server. On a Mac, brew install --cask kilerd/tap/anystorage; the macOS page and the Linux page cover the packages, and the S3 GUI client overview covers the protocol. Credentials stay encrypted on the local machine, there is no account to create, and the free tier covers two connections.

Mount a MinIO bucket as a drive

When a program accepts nothing but a path, AnyStorage re-serves everything currently connected — MinIO included — through a WebDAV server on your own machine at http://127.0.0.1:3211. No FUSE, no WinFsp, no admin rights: mount it with Finder's Connect to Server, Explorer's Map network drive, or dav://127.0.0.1:3211 in Nautilus or Dolphin. Read-only on the free tier, read-write on Pro. The mount walkthrough covers the S3 version of the same steps.

Questions