The classic attachment manager: renames and moves PDFs, attaches files, sends PDFs to a tablet and back, and extracts annotations.
ZotFile has Atlas grade C (not recommended) because a button in its settings downloads and runs a PDF tool on Intel Macs; it comes over plain http, so anyone on your network could swap it. It's a Zotero 6 plugin, so Zotero 7 and later can't load it. What to use instead. Last checked 6 Nov 2026.
Downloads a .xpi file (0.5 MB). In Zotero, open Tools → Plugins and install it from the file.
In useAn estimate of how many copies of Zotero have it: Zotero downloads each new version once for every copy that has the plugin, so we count the downloads of its most-downloaded recent release. Rounded. Plugins that update from outside GitHub count low.
16
DownloadsAll-time downloads of its release files from GitHub, counting every update. Installs from elsewhere aren't counted.
16
ReleasesVersions published on GitHub. Everyone who has the plugin downloads each one again, which adds up in Downloads.
1
StarsPeople who starred the repository on GitHub: a rough measure of interest.
0
ContributorsPeople who have committed code to the repository.
49
LicenceThe licence the code is published under, as GitHub reports it.
None stated
C
Atlas gradeNot recommended
A+ABCC
because a button in its settings downloads and runs a PDF tool on Intel Macs; it comes over plain http, so anyone on your network could swap it
Next rung: B, once nothing in the code is a serious concern.
Applies to v5.1.1, released 10 Jun 2022Code checked · not yet tested in a live Zotero
Legacy plugin for Zotero 6 onlyUses the old plugin format. Zotero 7 and later can't load it.
Fork of jlegewie/zotfileA copy of another listed plugin, changed by someone else.
Another plugin uses the same ID2 other plugins share this add-on ID. Zotero can only install one of them.
What we found in the codeSets the gradeThe worst finding in these three areas sets the grade.
Code transparencyReadable code; not yet checked against the published sourceThe developer uploaded the release file from the GrayXu account. We haven't yet checked whether this file matches the public source code.UnknownWe couldn't check this yet.
Updates
Updates come from jlegewie/zotfile, another listed project with the same add-on IDZotero will update it on Zotero 6 to version 5.1.2 from jlegewie/zotfile on GitHub (rated: Serious concerns found)
Where your data goesContacts developers' servers: www.zotfile.com and zotfile.com2 addresses in 1 group.MediumMedium concern: worth reading before you install. One medium finding makes the grade B.
Developer's servers (2)
www.zotfile.comzotfile.comnamed in its codeThe address is in its code, but we didn't trace a request to it. It may be a link or unused.
Where we found it
www.zotfile.comchrome/content/zotfile/options.js · line 645
var download = Downloads.createDownload({source: url, target: file});
Powerful capabilitiesA button in its settings downloads and runs a PDF tool on Intel Macs; it comes over plain http, so anyone on your network could swap it, and 4 moreHighHigh concern: a serious problem. One high finding makes the grade C.
High concern (1)
A button in its settings downloads and runs a PDF tool on Intel Macs; it comes over plain http, so anyone on your network could swap it
Medium concern (1)
Launches programs on your computer
Low concern (3)
Uses the clipboardRuns code it assembles while runningWorks with files on your computer
Where we found it
A button in its settings downloads and runs a PDF tool on Intel Macs…chrome/content/zotfile/options.js · line 645
It downloads over unencrypted http and nothing checks the file, so anyone on the same network, such as public Wi-Fi, could swap in a program of their own. A button in its settings (Intel Macs only) downloads ZotFile's Poppler tool from zotfile.com and runs it; the README doesn't mention it. The file is no longer on the server, so today the button fails.
var download = Downloads.createDownload({source: url, target: file});
Launches programs on your computerchrome/content/zotfile/options.js · line 650
Programs it names include unzip
var proc = Components.classes["@mozilla.org/process/util;1"].
Before you installShown, not gradedFacts to help you decide. They don't change the grade.
Works withZotero 6 only (legacy plugin)Doesn't work with the current Zotero (10)MediumMedium concern: worth reading before you install. One medium finding makes the grade B.
2 other plugins use the same ID as this one. Every Zotero plugin carries an ID, a name tag Zotero uses to tell plugins apart. These 3 plugins carry the same one, because people copied ZotFile to make their own versions and kept its ID.Show what this means
You can only have one. Zotero sees them as the same plugin.
Installing another replaces it. If you install one of the others, it takes this one's place.
Check what you install. Several share this plugin's name, so make sure the file comes from the one you meant.
The developer hasn't responded. Developers can reply here, and their reply sits next to our findings.I'm the developer
Ratings and reviews
What people who use it say. This is separate from the grade, which is what the code does, and never changes it.
No ratings yet.
Write a review
Google Analytics stays off unless you accept.When it's on, it counts your visit: Google gets your IP address, your browser and the pages you view here, searches included, and sets its cookies. More about this