ESScan Dropbox read-only
Dropbox duplicate finder

Trace duplicate Dropbox files with the fingerprint Dropbox already knows.

ClearCopies walks the connected Dropbox namespace, pairs each file's byte size with its provider-supplied content_hash, and keeps shared-file context beside every candidate. Scanning is read-only; no copy is moved or deleted.

Scan Dropbox read-onlyReview security

Implementation verification · August 2026

Tested with Dropbox namespace and content-hash rules

The provider tests exercise recursive listing, account-root namespace handling, path preservation, quota reporting, and Dropbox content_hash normalization. Write scope is absent from the initial OAuth request.

Read-only
initial OAuth
Recursive
folder inventory
content_hash
exact evidence

Dropbox team spaces and shared paths can change what a keeper means, so byte-identical groups remain reviewable instead of becoming automatic deletion instructions.

Written by ClearCopies Editorial · Technical review by ClearCopies Engineering

How it works

A Dropbox scan that respects namespaces and sharing

Dropbox can place personal folders, mounted content and team-space roots behind one account. ClearCopies starts from the account's current root namespace and follows Dropbox pagination instead of assuming a flat personal folder.

  1. 01

    Connect with read scopes

    Dropbox grants account, metadata, content-read and sharing-read scopes. There is no files.content.write permission in the first connection.

  2. 02

    Enumerate the current namespace

    The adapter scans recursively, includes mounted folders, follows continuation cursors and ignores entries Dropbox already marks deleted.

  3. 03

    Compare Dropbox-native evidence

    Files become exact candidates when their byte sizes and content_hash values match. Paths and sharing signals stay visible for the keeper decision.

Provider-native fingerprint

Dropbox content_hash is its own fingerprint format

Dropbox computes content_hash from blocks of file data and returns the result with file metadata. ClearCopies uses that value as a Dropbox-specific fingerprint; it does not relabel it as ordinary MD5, SHA-1 or whole-file SHA-256.

  1. 1

    Dropbox metadata

    path + byte size + content_hash

  2. 2

    Normalized signal

    content_hash algorithm + fingerprint value

  3. 3

    Exact candidate

    same bytes + same Dropbox fingerprint

A matching name, revision label or folder position is not a content match. If Dropbox does not return content_hash for an item, ClearCopies leaves it outside the automatic exact set.

Least-privilege access

What the Dropbox connection reads—and what stays blocked

Dropbox separates read and write scopes. ClearCopies requests the reads needed for inventory, sharing context and optional review previews, while leaving write access unrequested.

Reads for the scan

  • Recursive file metadata

    Names, display paths, IDs, revisions, byte sizes and client/server modification times.

  • Dropbox duplicate evidence

    The provider's content_hash plus byte size, without recomputing a hash from a full file download.

  • Sharing and optional previews

    Sharing indicators and small provider thumbnails when a supported file needs visual review.

Does not do

  • Use content-read to prove duplicates

    The files.content.read scope supports optional thumbnails; duplicate grouping itself uses the content_hash in metadata.

  • Delete, move or rename Dropbox items

    The initial token has no files.content.write scope, so scan-time changes are not authorized.

  • Treat revisions as duplicate proof

    Dropbox revision IDs track file versions; they are review context, not a cross-file content fingerprint.

Trash requires separate permission

A future reviewed move to Dropbox deleted files would be a different operation. It would need separate files.content.write consent and the ClearCopies cleanup gate enabled; neither is part of the read-only scan.

Tools and guides

Turn Dropbox candidates into a cautious keeper plan

Compare provider fingerprints locally, flag collaboration risks and document which path should remain before any later write-enabled workflow is considered.

Browse all toolsBrowse all guides
Dropbox FAQ

Questions about scanning Dropbox

Straight answers about fingerprints, permissions and the boundary between review and cleanup.

What is Dropbox content_hash?

It is Dropbox's provider-specific content fingerprint, calculated from file blocks and exposed with metadata. It should only be compared with another Dropbox content_hash value, not with a generic MD5 or SHA value.

Why does ClearCopies request files.content.read?

The scope allows ClearCopies to request optional Dropbox thumbnails for review. Exact duplicate grouping uses the content_hash already present in metadata rather than downloading file bodies to hash them.

Does the scan include Dropbox team spaces?

The adapter resolves the connected account's root namespace, includes mounted folders and enumerates recursively. Results still depend on the folders and team-space content visible to that account.

Can ClearCopies delete Dropbox files after this connection?

No. The initial OAuth token does not include files.content.write. A future trash step would require separate write consent after review and an independently enabled server cleanup gate.

Are matching Dropbox filenames enough to mark an exact duplicate?

No. Exact candidates require matching byte sizes and matching content_hash values. Names and paths help with review but do not prove identical content.

Review exact Dropbox

Connect Dropbox with read-only access, inspect the fingerprint evidence, and decide which path matters before any future cleanup step.

Review securityScan Dropbox read-only