Dropbox status: access issues and outage reports

Problems in the last 24 hours

The graph below depicts the number of Dropbox reports received over the last 24 hours by time of day. When the number of reports exceeds the baseline, represented by the red line, an outage is determined.

Most Reported Problems

The following are the most recent problems reported by Dropbox users through our website.

• Errors (75%)
• Website Down (25%)

Live Outage Map

The most recent Dropbox outage reports came from the following cities:

City	Problem Type	Report Time
Nottingham	Errors	1 month ago
Guayaquil	Website Down	1 month ago
Flumet	Errors	1 month ago
Irapuato	Errors	1 month ago
Bournemouth	Sign in	3 months ago
Paramaribo	Errors	4 months ago

Full Outage Map

Community Discussion

Tips? Frustrations? Share them here. Useful comments include a description of the problem, city and postal code.

Beware of "support numbers" or "recovery" accounts that might be posted below. Make sure to report and downvote those comments. Avoid posting your personal information.

Dropbox Issues Reports

Latest outage, problems and issue reports in social media:

• 
  Polsia (@polsia) reported 6 minutes ago

  Dropbox treats an 80GB Unreal project like any other folder. Mid-previz, it chokes. Built Cinderquay to fix that — local-first sync, assets on NVMe, peer-to-peer mesh, ***-style versioning for binary blobs. Studios building worlds shouldn't pay egress to anyone. Live soon.

• 
  Mikemira (@storiesbyohama) reported 7 minutes ago

  Just imagine getting accepted into the most exclusive startup club on earth… Then being told you have two weeks to find a complete stranger to as your partner. That’s exactly what happened to Drew Houston in 2007. He had the idea for Dropbox. He had a rough demo. @ycombinator liked it. But @paulg was clear... Single founders rarely make it. You need a co-founder. Right now. Drew’s friends couldn’t join. Time was running out. What would you do? He put out the word. A mutual friend connected him to a quiet MIT student named Arash Ferdowsi. They had never met. They sat down in the student center. Talked for about two hours. About code. About the problem. About the future. At the end of that conversation Arash said yes. He dropped out of MIT the next week with only one semester left. Two weeks later they walked into the YC interview together. They got in. The rest is history: a company that became worth billions. It looked reckless. It felt like a shotgun wedding. Yet it worked because both were all-in from the first conversation. I’ve studied hundreds of startups that never made it past the idea stage. Most founders wait too long for the “perfect” partner. They overthink chemistry. They protect their equity. They miss the window. You can’t wait for certainty. Sometimes the right co-founder is the person willing to jump with you before the proof exists. The speed of that decision can be the difference between staying a solo dreamer and building something real. What would you risk in two weeks if the right person walked in?

• 
  Luke Elin (@LukeElin) reported 8 minutes ago

  👤Shadow Adoption The pattern: Staff route around the sanctioned tool, and the organisation finds out afterwards. I watched this with unauthorised modems. Then with USB drives. Then with Dropbox. Then with entire SaaS platforms procured on a personal credit card and expensed as “software.” Now it is AI the same movie, new cast, better production values. The reason is always identical and always reasonable: the sanctioned tool is slower than the job requires. Shadow adoption is not an indiscipline problem. 👊 It is a feedback signal about the official tooling, arriving through the wrong channel. The tell: Compare the usage figures for your officially sanctioned tool against what your helpdesk volume implies people are actually doing. The gap is your shadow estate. FR FR

• 
  Lando, the Chef (@_Lando7763) reported 9 minutes ago

  @PhyxicxGaming Thanks. And unfortunately it's even worse than that because it's technically "shared housing;" the place was already a ******** when I got here. No pests, fortunately, and I'm pretty sure the landlord has no idea what goes on here, and doesn't care. I've only ever met the maintenance man, who handles move-ins, plus he picks up rent from the dropbox every week. I haven't seen him since the day I moved in, and he even told me as much that I'll never meet the owner. The psycho has his room on the 3rd floor, I'm one of two on the 2nd floor, and there's one person below me. The bathroom is shared, as is the kitchen, which I never use. Only one burner on the stove works anyway. On my first day, I texted about the broken toilet seat, and the Landlord asked me what happened. WTF? Third-Floor Psycho is the only other person who's walking around raging regularly. Everyone else recognizes the general "peace" of the environment. Unfortunately I have to be here at least a few more months, while I'm still paying off old bills, and re-establishing myself in a new city. It's a slow journey, but a steady one. I just happen to hit a ****** rest stop here and there.

• 
  M.Ellis (@MEllisPhotograp) reported 9 minutes ago

  @DropboxSupport any know issues with desktop and web site of yours lately ? my account has been very slow and annoying today YES I TRUST MY COMPUTER so instead you ask me 4 times before i just log off and give up...

• 
  Bruno Marsino (@BrunoMarsino) reported 9 minutes ago

  Company for AI age: - Information should flow flat - Can’t wait to have all information to make decisions - Speed and excelente in execution is crucial - You should get as much info as possible during the constraint of time given by yourself - How do we prepare a company to be totally eligible for AI? Not only text info but images - Service of the future is not about giving agents to corps to solve problems but offering the solution/service driven by AI. - Even if all information is on the web, multiple file structures, owners, formats and file storage systems (dropbox, drive, box) add friction to information and decision making

• 
  kfd&p (@kfdpcom) reported 15 minutes ago

  @mellolais___ @LIBSCRUSHER @Dropbox I went on their site and it does say that the .com access is having issues. I guess we just wait it out.

• 
  Brandon (@BJohnsonxAR) reported 15 minutes ago

  @DropboxSupport I’m having issues logging in. When I try to login it’s making me sign up when I already have a paid account. This is happening on both the app and my browser. @Dropbox

• 
  Shoost (@Shoost_Product) reported 17 minutes ago

  Shoost updated: v0.17.3 → v0.17.4 #Shoost Bug Fix: Fixed a bug where files could not be saved correctly when saving to a folder synced with a cloud service (e.g. Dropbox)

• 
  Ed Giansante (@edugiansante) reported 17 minutes ago

  86% of small businesses still haven't fully integrated ai into their operations. which is funny, because the tools are already here. they're everywhere. there's probably one open in another browser tab right now, quietly waiting to change your life. Goldman Sachs surveyed small businesses and found that only 14% have fully integrated ai into their operations. i don't think the other 86% are anti-ai. they're busy. they're cautious. and they probably don't want to add “company-wide ai transformation” to the list of things they need to worry about before lunch. honestly, fair. @paulg said something recently that I keep coming back to: "If the world is going to get turned upside down, the safest place to be is in a small, fast-moving company that can easily change direction." small companies should be the ones moving fastest. but most are still waiting for someone else to go first. someone else to test the tool. someone else to write the playbook. someone else to promise that nothing will get weird. @clairevo nailed the real blocker: "the blocker is never tools or intelligence. human systems, human problems." i've spent 15 years watching this happen. At Dropbox. At Wix. At Zynga. Now at Persona. different tools. different eras. same pattern. a team finds a new tool. everyone gets excited. someone schedules a kickoff. three weeks later, everyone is back in the old spreadsheet. not because people are stupid. because changing how people work is uncomfortable. and buying software is much easier than changing behavior. i've seen the same thing with community-led growth. i used to pitch community to executives who had every tool and dashboard money could buy. they'd nod. they'd agree it worked. then they'd return to the comfortable world of automation, sequences, and dashboards that made everyone feel productive. last year, i ran 86 events as a team of one and built $3M in pipeline. the secret was not a magical growth hack. it was showing up. knowing the 15 people in the room by name. listening carefully. creating a space where people could actually trust each other. not exactly the kind of thing you can solve with a 47-step workflow. ai adoption and community adoption have the same problem. the tools work. the ideas work. the uncomfortable human part is where things usually slow down. sitting with your team and figuring out what should change. trying one workflow instead of redesigning the entire company overnight. leading people through something new instead of sending a Loom video and hoping everyone feels inspired. the 86% aren't waiting for better ai. they're waiting for change to feel a little less scary. so start small. pick one annoying workflow. try one new thing. make it 10% better. then do it again. the tools are here. the next step is still a very human conversation. and, unfortunately, probably a meeting.

• 
  Juan Pabro (@ironwoodreserve) reported 17 minutes ago

  @BitPaine @Dropbox Is now the worse time to try to login? I was a sent 2FN right as I was getting ready to click on what to use to login. It seemed way too fast for 2FN.

• 
  Shadow_Vortex_2025 (@Shad0wV0rtex) reported 21 minutes ago

  @FrancoisOlwage @bot I ran into a similar issue just trying to connect Dropbox, ClickUp, and Google Sheets, and all my tokens were already gone.

• 
  StockStorm (@StockStormX) reported 23 minutes ago

  Dropbox $DBX says about 5,000 accounts were compromised in an August hack tied to a Lenovo ID login flaw

• 
  True Become False (@trubecomefalse) reported 25 minutes ago

  @imbabybrooklyn HN had a terrible track record. They were anyi bitcoin 1 month after it launched. Same with Dropbox, discord and a few others off the top of my head.

• 
  Lalit Dhalia (@lalit_dhalia) reported 27 minutes ago

  @GrokInsider U are acting exactly like that hackernews comment who was shitting on Dropbox launch, "u can setup your own ftp server". Same energy guy. If u have to ask this, u are NOT the audience bro. Come on.

• 
  Bit Paine ⚡️ (@BitPaine) reported 27 minutes ago

  I’m not seeing this reported anywhere on my feet, but there was a terrible data breach at @Dropbox. Not sure of the scale and how many accounts were compromised, but apparently the attackers utilized an exploit with Lenovo ID integration that backdoored access into Dropbox accounts bypassing completely 2FA, and other security measures, and it didn’t matter if you had a Lenovo account or not. The attackers simply signed up for a Lenovo account using your Dropbox-linked email and the exploit on Lenovo’s end allowed an account to be created without any verification that the attacker controlled the email address. This completely bypassed all of Dropbox’s security measures, and even gave the attackers access to documents stored within the client’s Dropbox. If you stored any potentially sensitive material within a Dropbox account, it would be a good idea to make sure it was not compromised and of course, move it immediately. Luckily, I was not compromised as far as I know, but to me this is an unforgivable oversight on the part of Dropbox security and I will be canceling my longtime subscription with them. Apple‘s iCloud offers superior security, including the option for end-to-end encryption which they call “Advanced Data Protection (ADP).” With ADP turned on, not even Apple can access your data without the decryption key.

• 
  MEGA (@MEGAprivacy) reported 31 minutes ago

  Dropbox users just got hacked through a Lenovo login, not their Dropbox password. A stolen session should still hit a locked box. That’s what end-to-end encryption is for, and how MEGA is built. Without E2EE, stealing the session is stealing the files. With it, they only get scrambled data.

• 
  echelon_zero (@echelon_zero) reported 36 minutes ago

  @dhh @renefaurskov Do you have a contact at dropbox that could fix the install on linux to point the dropbox to a folder other than default. Having to pause it and link to another folder after install is mentally unhealthy.

• 
  More Gravy (@lotsmoregravy) reported 40 minutes ago

  @FFT1776 Deputize our military and send them to literally every last damn polling station and dropbox in the United States of America. Every last damn one. Give them the authority to handle **** on the spot. Problem solved.

• 
  Noise (@NoiseesoiN) reported 41 minutes ago

  @esrtweet @EricRichards22 What's funny is that having gigabit on my end isn't the issue. It's connecting to servers which have enough bandwidth to feed it. My line can pull lots of data, but when I'm connecting to Dropbox, I'm lucky to get a third of that (and usually a tenth).

• 
  numaan (@numaan27) reported 42 minutes ago

  they solved this problem in panda by splitting the key space into “ranges.” each range is roughly 100 GB, so when a range grows too large, it can be split and redistributed. (btw panda is an abstraction layer over sharded mysql that dropbox built)

• 
  Christopher Doyle (@djfunboy) reported 44 minutes ago

  @iamlukethedev CLI updates changed the signed binary and dropped macOS permissions Dropbox/TCC made jobs work interactively but failed headless (this took some time to figure out) Claud auth refresh broke and continue to break despite multiple attempts and setup tokens. Agent confusing to use API vs subscriptions. Article jobs failed on missing configs, QA turn limits, and clunky validataion Digest existed but failed to pick up silent failures Some jobs reporting done while producing nothing, without a final artifact verification I am an experienced builder but also self/agent taught so these are mostly setup and validation issues. My bigger point is that these take work and especially the more complex tasks. I am still early and I have put more work than value created but I can see the light at the end of the tunnel.

• 
  dreadnaught (@dr3dn0t) reported 44 minutes ago

  @priestessofdada this dude could have worked at dropbox, ibm, cnet, duolingo, etc. all of them offloaded people by that time in favor of AI. skids hadn't figured out what to do with AI yet because someone hadn't laid out instructions for them. by the time they were starting to flood social media, several companies had made some pretty large public facing fuckups due to their shift to AI, which seems to have slowed down mass adoption. now if we're gonna play the intentionally dishonest game of "AI took my exact job" then you are correct. every single company that did this crap ended up consolidating roles. so there is no exact position to fill.

• 
  Kyngsly (@RelentlesslyK) reported 54 minutes ago

  @yettydlaw_ @MTNNG MTN will likely be able to explain it away... Anyway, this how Claude explained. "708GB over 104 days works out to about 6.8GB a day. That sounds shocking until you break down what actually eats data on a modern 5G phone. The usual culprits, roughly in order of how often they turn out to be the answer: Video, especially autoplay. TikTok, Instagram Reels, YouTube Shorts and X video. Scrolling Reels for two hours can burn 4 to 6GB on its own. “Social media and browsing” is exactly the usage profile that quietly does this. 5G itself. This one gets missed constantly. Video players negotiate bitrate based on available throughput. The same 30 minutes of YouTube that cost 300MB on 3G can cost 2GB on 5G because the player auto-selects a much higher resolution. Nothing changed in behavior, but consumption multiplied. Wi-Fi Assist / Adaptive Connectivity. iPhone and Android both silently fall back to cellular when Wi-Fi gets weak. The phone shows the Wi-Fi icon while pushing traffic over the mobile network. People assume they’ve been on Wi-Fi at home all evening when they haven’t. Cloud photo backup. iCloud Photos or Google Photos set to back up over cellular. A few 4K videos is several GB right there. Hotspot and tethering. A laptop pulling Windows updates, OneDrive or Dropbox sync, or a Zoom call. Also worth asking whether the SIM ever sits in a MiFi or router. Background refresh and auto-updates. App store updates over cellular, plus dozens of apps refreshing in the background. Video calls. WhatsApp video runs roughly 300MB an hour, Zoom or Meet more. On the operator side, real errors do happen: duplicate charging, subscription add-ons deducting from the bundle, or misapplied tariffs. But there’s also a structural point worth knowing. Carriers meter at the network layer, so they count protocol overhead and retransmissions, and in a poor RF environment retransmissions can add a real percentage on top of the payload the app thinks it sent. One practical note on that complaint: the app-level breakdown being demanded is hard for any carrier to produce. Traffic is encrypted end to end, so MTN can see volume, timing and destination IP or SNI, but not “3.2GB attributable to Instagram” in any reliable, retained form. The chronological deduction ledger and the subscription/add-on audit are the demands most likely to actually produce something. The fastest self-diagnosis is Settings > Cellular on iOS or Network & Internet > Data usage on Android, sorted by app, with the counter reset date checked. "

• 
  Eric Taylor (@bcs_erictaylor) reported 55 minutes ago

  Really?? Dropbox really needs a MCP server? CVE-2026-81102 The Dash MCP server bound its listener to the loopback address but never checked the host a request named. src/mcp_server_dash.py constructed the server for its network mode with the interface restricted to loopback and no transport-security settings, so a name that had been pointed at the loopback address still reached the listener while carrying the attacker's host name. A page in a visitor's browser could therefore drive the local server and invoke its company-search and file-detail tools under the Dropbox credential the server holds. Only the network mode was reachable this way; the standard input mode was not. The fix supplies transport-security settings that enable host checking and allow only the loopback name and port, rejecting other hosts before a tool runs. The repository publishes no versions, so the affected boundary is the commit preceding the fix.

• 
  Karishma Bhardwaj (@bkarishma360) reported 58 minutes ago

  @shahzamannn_ Your SaaS idea doesn’t need to be complicated. Stripe moves money. Postman sends API requests. Notion organizes information. Dropbox syncs files. The lesson? Simple problem + huge market + great execution = massive company. Stop asking, “Is my idea too simple?” Start asking, “How many people have this problem?”

• 
  Mansi 👩‍💻 (@MansiCodez) reported 60 minutes ago

  Solution of yesterday’s question: Design Google Photos: the part after the boxes “Hash it and put it in S3” fails the interview. Two phones compress the same sunset differently. Same photo. Two hashes. Two rows. You just built a worse Dropbox. The system needs three IDs, not one. client_upload_id — generated on the device before the first byte moves content_hash — hash of the exact bytes you received asset_id — the thing the user sees in the library Uploads are sessions. Library entries are assets. Blobs are renditions. If you collapse those into one key, retries, edits, and shared albums all collide. 1. Retries must be idempotent on the client, not on the filename Phone goes offline mid-flight with 612 shots, 40 already half-uploaded. Each photo gets a client_upload_id the moment it enters the queue. Chunks are uploaded against that ID. Commit is PUT /uploads/{id}/complete. Same ID + same bytes → same session. Server returns the existing asset. Late packet after commit is a no-op. Filename + timestamp is not an ID. Camera roll and AirDrop will mint two. 2. Exact dupes are content-addressed. Near-dupes are reconciled. After commit: look up sha256(bytes) if it already exists for that user (or the shared album’s owner set), attach the new upload to the existing asset_id do not create a second photo The 28 shared “Goa 2026” shots that are almost-but-not-quite the library copies will miss on sha256. That is expected. Run a cheap perceptual hash (pHash / dHash) + capture time + camera model from EXIF. If distance is tiny and captured within a few seconds, mark as near_duplicate_of and do not show two tiles. Keep both blobs if you must; hide one in the UI. Two devices, two compressions, one photo in the grid. 3. The library is a set of assets + tombstones. Not last-write-wins. Delete in Delhi must beat a pending upload in Mumbai. Every mutation carries: asset_id op: upsert | delete | restore actor_id (device or user) logical_ts (per-actor Lamport or hybrid logical clock) A deleted asset gets a tombstone that outlives the pending queue. When the flight-mode phone finally flushes those 40 half-uploads, the server sees: upload commit for an asset that already has a newer delete → commit the blob if you want, do not resurrect the tile. Refresh in Mumbai cannot show a photo Delhi just deleted, because the change feed is “tombstone wins over delayed create,” not “whoever wrote last.” 4. Shared albums are references, not copies Partner adds 28 photos to Goa 2026. The album stores {asset_id, added_by, added_ts} — not a second blob, not a second library row. Adds and removes are a small CRDT: add(asset, actor, ts) remove(asset, actor, ts) Two devices adding the same asset = one membership row. Phone sync finishing a second later cannot wipe the partner’s 28 photos, because there is no “replace the whole album document.” Last-write-wins on the album JSON is how photos vanish. 5. An edit is a new rendition, not a new photo and not an overwrite User crops + filters while the original is still processing. Rules: original blob is immutable edit creates rendition_id with parent_asset_id library still shows one asset “current view” pointer moves to the latest rendition history is a list of renditions / edit ops, not 12 full-resolution copies by default If you overwrite the original, face clustering and search lose their source. If you mint a new asset, the user now has original + edit as two photos. Both are wrong. Storage stays sane because you store: original (once) derived thumbs / display sizes lazily, keyed by asset_id + transform not every intermediate crop as a first-class photo 6. Upload path and ML path must not share a lock “Beach sunset with Priya” in minutes, not overnight, also not on the upload critical path. Commit path only: durable bytes asset row appear in library + album enqueue jobs Workers (thumbs, embeddings, face cluster, labels) are async. Search index is eventually consistent. The UI can show the photo immediately with “processing” on faces. If clustering blocks upload, you built a spinner, not Photos. Face identity hangs off asset_id, so an edit does not orphan Priya. The new rendition inherits the parent’s cluster and gets re-checked, not reset. 7. Sync is a checkpoint + change feed, not “download the library” Each device stores last_applied_ts. Server gives a stream: new assets, new renditions, album membership, tombstones. That is how 62,000 existing photos plus 612 offline shots plus 28 shared adds converge without a full rescan, and why a deleted photo does not climb out of another device’s queue. The one-line design Client-generated upload IDs stop retries from cloning. Content hashes stop exact clones. Perceptual reconcile stops “same sunset, different JPEG.” Tombstones stop resurrection. Album CRDTs stop last-write-wins from deleting the partner’s night. Edits are renditions under one asset. ML is a consumer of commit, never part of it. Boxes for S3, CDN, Kafka, Redis are table stakes. This is the part that decides whether you designed Google Photos or a photo-shaped file dump.

• 
  virgin loser (@stonershelb) reported 1 hour ago

  He put a photo of their 2 yo daughter naked with exposed genetalia in a Dropbox folder that “received more than 400,000 combined views or interactions. ... and it was publicly accessible for 23 hours before she says Minc acknowledged responsibility and took it down.”

• 
  CHItrader (@CHItrader) reported 1 hour ago

  DBX LEAKS 5,000 ACCOUNTS ON A SIDE DOOR $DBX just told about 5,000 users their boxes got hit Aug 4-21 through a leftover $LNVGY login. Email was enough. No 2FA on the wrecked accounts. 🔹 Files touched on fewer than a third of them, call it ~1,500 🔹 Dropbox cut the Lenovo link and now wants a real password 🔹 After-hours ate the stock when Bloomberg printed it Cloud storage with a guest list and no bouncer. Cool product.

• 
  Phillip Shoemaker (@pbsIdentity) reported 1 hour ago

  India just ordered hundreds of Google Firebase accounts shut down after authorities found scammers using the platform to impersonate major banks. At least 57 Firebase-hosted websites and databases were targeted for takedown this month alone. Some mimicked banks. Others distributed malicious Android apps. Some were designed to steal financial information from phones. Here's what I find interesting. Firebase isn't some shady hosting company operating out of a basement. It's Google infrastructure. That's exactly why criminals want it. We've spent years teaching people to look for obvious signs of scams. Weird domain. Broken English. Sketchy hosting. Browser warning. No HTTPS. But increasingly the attacker doesn't need to build suspicious-looking infrastructure. They borrow legitimate infrastructure. Google. Microsoft. Cloudflare. GitHub. Dropbox. Whatever gives the attack credibility and reliability. Now imagine the average person inspecting the link. They recognize Google. The connection is encrypted. The page loads perfectly. The certificate is valid. Everything their brain has been trained to interpret as: SAFE may technically be true. Except the person controlling the page is a criminal. That's an important distinction. HTTPS proves your connection to the website is encrypted. It does not prove the person operating the website is honest. A Google URL proves Google is providing infrastructure. It doesn't necessarily prove Google created the content you're looking at. The little padlock was never a morality detector. We just accidentally trained an entire generation to treat it like one. India says scammers have increasingly shifted toward Firebase because its legitimate development tools and database functionality make it useful infrastructure for fraudulent sites and apps.