Renames, moves and attaches PDFs and other files to items, syncs PDFs to a tablet or mobile reader, and extracts PDF annotations into notes.
ZotFile has Atlas grade C (not recommended) because a button in its settings downloads and runs a PDF tool on Intel Macs; it comes over plain http, so anyone on your network could swap it. It's a Zotero 6 plugin, so Zotero 7 and later can't load it. What to use instead. Last checked 6 Nov 2026.
Downloads a .xpi file (0.5 MB). In Zotero, open Tools → Plugins and install it from the file.
In useAn estimate of how many copies of Zotero have it: Zotero downloads each new version once for every copy that has the plugin, so we count the downloads of its most-downloaded recent release. Rounded. Plugins that update from outside GitHub count low.
9
DownloadsAll-time downloads of its release files from GitHub, counting every update. Installs from elsewhere aren't counted.
12
ReleasesVersions published on GitHub. Everyone who has the plugin downloads each one again, which adds up in Downloads.
5
StarsPeople who starred the repository on GitHub: a rough measure of interest.
0
ContributorsPeople who have committed code to the repository.
53
LicenceThe licence the code is published under, as GitHub reports it.
None stated
C
Atlas gradeNot recommended
A+ABCC
because a button in its settings downloads and runs a PDF tool on Intel Macs; it comes over plain http, so anyone on your network could swap it
Next rung: B, once nothing in the code is a serious concern.
Applies to v5.1.2.9001, released 23 Dec 2022Code checked · not yet tested in a live Zotero
Legacy plugin for Zotero 6 onlyUses the old plugin format. Zotero 7 and later can't load it.
Fork of jlegewie/zotfileA copy of another listed plugin, changed by someone else.
Another plugin uses the same ID2 other plugins share this add-on ID. Zotero can only install one of them.
What we found in the codeSets the gradeThe worst finding in these three areas sets the grade.
Code transparencyReadable code; not yet checked against the published sourceThe developer uploaded the release file from the domiden account. We haven't yet checked whether this file matches the public source code.UnknownWe couldn't check this yet.
Updates
Updates come from jlegewie/zotfile, another listed project with the same add-on IDThe update address offers version 5.1.2, which isn't newer than this one, so Zotero won't update it for now
Where your data goesContacts developers' servers: www.zotfile.com and zotfile.com2 addresses in 1 group.MediumMedium concern: worth reading before you install. One medium finding makes the grade B.
Developer's servers (2)
www.zotfile.comzotfile.comnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.
Where we found it
www.zotfile.comchrome/content/zotfile/options.js · line 645
var download = Downloads.createDownload({source: url, target: file});
Powerful capabilitiesA button in its settings downloads and runs a PDF tool on Intel Macs; it comes over plain http, so anyone on your network could swap it, and 4 moreHighHigh concern: a serious problem. One high finding makes the grade C.
High concern (1)
A button in its settings downloads and runs a PDF tool on Intel Macs; it comes over plain http, so anyone on your network could swap it
Medium concern (1)
Launches programs on your computer
Low concern (3)
Uses the clipboardRuns code it assembles while runningWorks with files on your computer
Where we found it
A button in its settings downloads and runs a PDF tool on Intel Macs…chrome/content/zotfile/options.js · line 645
It downloads over unencrypted http and nothing checks the file, so anyone on the same network, such as public Wi-Fi, could swap in a program of their own. A button in its settings (Intel Macs only) downloads ZotFile's Poppler tool from zotfile.com and runs it; the README doesn't mention it. The file is no longer on the server, so today the button fails.
var download = Downloads.createDownload({source: url, target: file});
Launches programs on your computerchrome/content/zotfile/options.js · line 650
Programs it names include unzip
var proc = Components.classes["@mozilla.org/process/util;1"].
Before you installShown, not gradedFacts to help you decide. They don't change the grade.
Works withZotero 6 only (legacy plugin)Doesn't work with the current Zotero (10)MediumMedium concern: worth reading before you install. One medium finding makes the grade B.
Renames, moves and attaches PDFs and other files to items, syncs PDFs to a tablet or mobile reader, and extracts PDF annotations into notes.
An attachment manager from before Zotero had its own reader and renaming. A fork of jlegewie/zotfile for Zotero 4 and 5 only. Its developer says it is no longer actively maintained.
What you'll need
Detected automatically
We haven't detected any setup requirements. That isn't the same as none: check the developer's README.
Where your data goes
We found: contacts developers' servers: www.zotfile.com and zotfile.com. 2 addresses in 1 group.
Developer's servers (2)
www.zotfile.comzotfile.comnamed in its code
Evidence · file and line
www.zotfile.comchrome/content/zotfile/options.js · line 645
var download = Downloads.createDownload({source: url, target: file});
2 other plugins use the same ID as this one. Every Zotero plugin carries an ID, a name tag Zotero uses to tell plugins apart. These 3 plugins carry the same one, because people copied ZotFile to make their own versions and kept its ID.Show what this means
You can only have one. Zotero sees them as the same plugin.
Installing another replaces it. If you install one of the others, it takes this one's place.
Check what you install. Several share this plugin's name, so make sure the file comes from the one you meant.
The developer hasn't responded. Developers can reply here, and their reply sits next to our findings.I'm the developer
Ratings and reviews
What people who use it say. This is separate from the grade, which is what the code does, and never changes it.
No ratings yet.
Write a review
Google Analytics stays off unless you accept.When it's on, it counts your visit: Google gets your IP address, your browser and the pages you view here, searches included, and sets its cookies. More about this