Unshare · safety notes

What the code actually does

Unshare is a single web page that lists your Dropbox shared links and lets you switch them off in bulk. It runs entirely in your own browser, talks only to Dropbox, and has no server of its own. Below is every connection it makes and what each part of its JavaScript is for.

Reviewed file: unshare/index.html · 444 lines · one inline script, no external scripts · 7 Oct 2026

✓
Talks to one serviceDropbox's official API at api.dropboxapi.com. There's no other server, analytics or tracking.
✓
Uses two Dropbox actions"List my shared links" and "revoke this shared link". Nothing else.
✓
Doesn't store your tokenIt's held in memory for as long as the tab is open, then it's gone.
✓
Can't read or delete filesThe token only carries sharing permissions. Your files are never opened, moved or deleted.
✓
Nothing happens without a clickLoading is read-only. Revoking needs you to tick links and confirm in a dialog.
✓
No hidden codeThe script is plain, readable JavaScript in the file itself. It's not minified and loads nothing from elsewhere.

Every connection the page makes

This is the complete list. You can confirm it in your browser's developer tools (see Check it yourself).

Destination	When	What's sent	Why
`api.dropboxapi.com/2/sharing/list_shared_links`	You click Load links	Your token, plus a page marker if there are more than one page of links	Fetches the list of links you own: name, path, link URL, access level and audience.
`api.dropboxapi.com/2/sharing/revoke_shared_link`	You confirm Revoke	Your token and one link URL per request	Turns that single link off. One request per link, a couple per second at most.
`fonts.googleapis.com`, `fonts.gstatic.com`	Page opens	A normal font download. None of your data is included.	Loads the two typefaces. Google sees your IP address, as with any site using Google Fonts. If you run a local copy, delete the three font lines at the top of the file to remove this; the page falls back to system fonts.
Any link you click	Only on click	Nothing from the page	"open" next to a row opens that Dropbox link in a new tab. The token help links to Dropbox's developer site, and "What the code does" opens this explainer.

All Dropbox traffic uses HTTPS. The page makes no requests in the background and has no timers that phone home.

What happens to your token

You create it yourself on Dropbox's developer site, for an app only you own.
You paste it into a password field, so it's masked on screen.
When you click Load links, it's copied into a variable inside the page's script. It's never written to cookies, localStorage, the address bar or any file.
It's sent only in the Authorization header of requests to api.dropboxapi.com.
Closing or reloading the tab erases it. Deleting the app on Dropbox's developer page kills it everywhere, and it expires on its own after about four hours anyway.

What the token is allowed to do

Dropbox limits each token to the permissions ("scopes") ticked on the app. Unshare asks for only two:

Scope	Allows	Doesn't allow
`sharing.read`	Seeing your shared links and their settings	Opening, downloading or reading any file's contents
`sharing.write`	Creating, changing or revoking shared links and shared-folder membership	Deleting, moving or editing files; changing account settings, email or password

Unshare's code only ever uses sharing.write to revoke links. It never creates links or changes folder membership, even though the scope would technically allow it.

The code, part by part

The script runs top to bottom inside one self-contained function, so nothing leaks into other pages or tabs. Here's every part in order.

`call()` · the only function that talks to Dropbox

It sends a request to api.dropboxapi.com with your token. If Dropbox says "slow down" (rate limiting), or the browser can't read the reply, it waits and tries again: 3, 6, 12, 20, 30, 45, then 60 seconds. It gives up after seven retries. Every network request in the tool goes through here.

const API = 'https://api.dropboxapi.com/2/';   // the only server address in the script
r = await fetch(API + ep, {
  method: 'POST',
  headers: { Authorization: 'Bearer ' + token, 'Content-Type': 'application/json' },
  body: JSON.stringify(body ?? null)
});

`norm()` · tidies each link

It turns Dropbox's raw link data into the fields the table shows: name, path, file or folder, view or edit, audience (public, team, password), expiry, and whether you're allowed to revoke it. It's pure data shaping with no network access.

`loadAll()` · fetches your list

It runs when you click Load links. It asks Dropbox for your shared links and keeps asking for the next page until there are none left, skipping duplicates. If something goes wrong it explains in plain words, for example "token expired" or "missing permission". This step is read-only.

`visible()` and `render()` · draw the table

These apply your filter, search and sort, then draw the rows, the totals and the selection bar. Every file name and path goes through esc() before it's shown. That converts characters like < and " into harmless text, so a file with a strange name can't inject code into the page.

Event handlers · your clicks

These handle the filter buttons, the search box, sorting, the tick boxes and select all. Select all only ticks rows that are currently visible and revocable. The "copy" button puts one link on your clipboard. Nothing here contacts Dropbox.

Export CSV · a local download

It builds a spreadsheet of the list in memory and saves it straight to your computer's Downloads folder. The file is created inside your browser and never uploaded anywhere.

Revoke flow · the only part that changes anything

Clicking Revoke selected opens a confirmation box showing how many view and edit links, files and folders you're about to switch off. Nothing happens until you press the red Revoke button inside it. Then it:

sends one revoke request per ticked link, one at a time, about 0.35 seconds apart
marks each row "revoked", or shows Dropbox's reason if one fails
leaves failed links ticked so you can retry them, under the Failed filter
stops the moment you press Stop, leaving the remaining links untouched

Revoking only disables the link URL. The file or folder itself stays exactly where it is.

Demo mode · fake data

If you open the page with #demo at the end of the address, it loads 64 made-up links and simulates revoking them. In this mode the script never contacts Dropbox, so you can try the whole flow without a token.

What it never does

Read, download, move or delete files
Create new shared links
Change folder membership or invite anyone
Save your token or link list in the browser
Send data to any server other than Dropbox
Load scripts from other websites
Use analytics, cookies or tracking pixels
Run anything in the background or after you close the tab

Check it yourself

1 · Read the source

Press Ctrl+U (⌥⌘U on a Mac) on the Unshare page, or read the file on GitHub, where every change to it is in the public history. The script is near the bottom, in plain readable JavaScript. Search for fetch(: it appears once, inside call(), pointing at api.dropboxapi.com. There are no <script src=…> tags.

2 · Watch the traffic

In Chrome, press F12 and open the Network tab, then use the page. You'll only see requests to api.dropboxapi.com plus the Google Fonts files.

3 · Confirm you have the reviewed file

The SHA-256 fingerprint of the page described here is below. If what your browser is served matches, it's byte-for-byte the same file. On Windows run curl.exe -s https://jameslashmar.github.io/Chroma_motion_scripts/unshare/ -o unshare.html then certutil -hashfile unshare.html SHA256; on Mac run curl -s https://jameslashmar.github.io/Chroma_motion_scripts/unshare/ | shasum -a 256.

6cb9745d0e5960a5531b684bc791e6a117bb27003521da3d26f4cb13f492b975

If the fingerprint doesn't match, the file has been changed since this review. That might be a later update, but don't paste a token into it until someone has re-checked it.

4 · Clean up afterwards

Delete the app at dropbox.com/developers/apps when you're done. Any token made for it stops working immediately.