The file is on the phone. The form is on the computer. Fixed.
CrossUpload adds “Upload from your phone” to the upload button you already have. Visitors scan a QR code, pick a photo or document, and it appears in your form a few seconds later — no app, no account, no WhatsApp detour.
No credit card for the Free plan · Works with any website · English & Turkish
Allowed: PDF, JPG, PNG, HEIC · up to 10 MB each
From six steps to two
Today your visitor sends the file to themselves, downloads it, finds it, and uploads it again. With CrossUpload they scan and send.
Without CrossUpload
- Open WhatsApp or email on the phone
- Send the photo to yourself
- Open the chat on the computer
- Download the (compressed) file
- Find it in the Downloads folder
- Upload it to the form
With CrossUpload
- Scan the QR code with the phone camera
- Pick the file and tap Send
The verified file appears in the form on the computer. The visitor continues and submits as usual.
Why this works →Everything a serious upload flow needs
One small script for the browser, one hosted phone page, one honest API.
QR phone upload
Visitors scan a QR code and send a photo or document from their phone directly into the form open on their computer. No app, no account, no WhatsApp detour.
Embeddable file picker
Add a framework-independent upload picker to any button or file input with one script tag. Drag and drop, phone upload, progress, accessibility and English/Turkish locales built in.
Scanning & verification
Uploads land in private quarantine storage, are checked by size and real content type, scanned with ClamAV, and only then promoted to an immutable delivery copy.
Private delivery
Accepted files are private. Your backend requests short-lived CloudFront signed URLs when it needs them, and every file has an explicit retention deadline.
API, SSE & webhooks
Headless REST API with OpenAPI spec, authenticated server-sent events, idempotent session creation and HMAC-signed webhooks with retries.
Form integration
Integrate CrossUpload into ordinary HTML forms with a hidden field of file IDs, and validate those IDs on your server before attaching them to a record.
Add it in three steps
Create a project
Sign up, add your website’s origin, choose allowed file types and limits, and create a server API key.
Add a session endpoint
Your backend calls POST /v1/sessions with its secret key and returns short-lived credentials to the browser.
Attach the widget
One script tag and CrossUpload.attach() on your existing button. Accepted file IDs land in a hidden field.
<button type="button" id="upload">Upload a file</button>
<input type="hidden" id="attachments" name="attachment_ids" value="[]">
<script src="https://app.crossupload.com/v1/widget.js"></script>
<script>
CrossUpload.attach({
target: '#upload',
mode: 'picker',
sessionEndpoint: '/api/crossupload/session',
resultInput: '#attachments',
maxFiles: 3,
onComplete({ files }) { console.log(files); }
});
</script>Made for forms that ask for documents
Security is the default, not an add-on
Files upload straight to private quarantine storage with short-lived, narrowly scoped credentials. A background worker checks the real file type, scans it with ClamAV, and promotes the exact verified version to an immutable delivery copy. Only then does your form see it.
- Single-use, expiring QR pairing
- Separate credentials for server, desktop and phone
- HTML, SVG and executables rejected by default
- Private delivery with expiring signed URLs
- Signed webhooks with retries
Simple pricing. Only accepted files count.
Opening the picker, scanning a QR code, retries and rejected files are free.
Free
- 100 accepted files/month
- 10 MB per file
- 7-day retention
Starter
- 2,000 accepted files/month
- 25 MB per file
- 30-day retention
Pro
- 10,000 accepted files/month
- 50 MB per file
- 90-day retention
Business
- 50,000 accepted files/month
- 100 MB per file
- 180-day retention
Stop losing visitors at the upload step
Start on the Free plan in a couple of minutes. Questions? Write to master@crossupload.com.