How to Open Parquet from S3 Privately in Your Browser

Most Parquet workflows eventually land in object storage — analytics buckets on AWS S3, exports on Cloudflare R2, or a MinIO cluster behind the firewall. The usual next step is a notebook or CLI script just to peek at schema and row counts. viewparquet lets you do that in the browser instead: point at the object, run SQL, and inspect results — without uploading the file to us.

This guide walks through every path in Open from S3 / URL and how to stay private while doing it.

What stays private

For viewing and SQL, viewparquet does not proxy or receive the remote object data. Optional AI is a separate browser-to-provider request. It sends your messages and configured context; chat tools and saved AI context may also provide structural metadata and SQL to the provider. When you open a remote source:

• When the endpoint supports HTTP range requests, DuckDB-WASM can fetch Parquet footers and relevant row groups in byte ranges. Actual transfer depends on the query, selected columns, row-group layout, statistics, codecs, and endpoint behavior; a full scan can still transfer much of the object.
• Access keys and session tokens are registered as an in-browser DuckDB secret — they sign requests locally and are not sent to viewparquet servers.
• Recent sources are remembered without secrets so you can reopen public URLs in one click; private buckets prompt you to re-enter keys.

In DevTools → Network, confirm that object-data requests go to your configured bucket or CDN rather than through a viewparquet data proxy. The page can also make separate asset, telemetry, error-monitoring, support, or optional AI requests.

Path 1: Public HTTPS or presigned URL

Best for: open datasets, short-lived presigned links, or any object already reachable over HTTPS.

1. Open the viewer and click Open from S3 / URL (or land with ?open=remote).
2. Choose the URL tab.
3. Paste a full HTTPS URL, for example:
   • https://example.com/data/events.parquet
   • A presigned S3 URL (query string included)
4. Leave format on Auto-detect unless you know the type.
5. Click Open.

DuckDB's httpfs extension loads inside WASM and requests the remote file. For Parquet, it can use HTTP ranges when the host supports them; a full scan or non-range host may transfer most or all of the object. A public or presigned URL needs no separately entered access keys, although a presigned URL contains temporary authorization.

Path 2: Public s3:// objects

Best for: anonymously readable buckets (common for public datasets).

Use the URL tab with an s3:// URI:

s3://my-public-bucket/path/to/file.parquet

DuckDB resolves the bucket in your chosen region (default us-east-1 for anonymous reads). If the object is not public, switch to the credentials path below.

Path 3: Private buckets (AWS, R2, GCS, MinIO)

Best for: production data that requires SigV4 signing.

1. Open Open from S3 / URL → Credentials tab.
2. Pick a provider preset:
   • Amazon S3 — access key + secret + region
   • Cloudflare R2 — R2 access key; endpoint <account_id>.r2.cloudflarestorage.com
   • Google Cloud Storage — HMAC key (Interoperability) as key + secret; endpoint storage.googleapis.com
   • MinIO / custom — your host, path-style addressing, optional HTTP for local dev
3. Enter the s3://bucket/key path to your Parquet (or CSV / JSON) object.
4. Optionally add a session token for temporary STS credentials.
5. Click Open.

Keys exist only for the current browser session's DuckDB instance. They are not persisted in localStorage. Reopening a saved private source from Recent will ask for credentials again — by design.

After the file is open

Once loaded, the workbench behaves the same as a local file:

• SQL editor — DuckDB SQL features supported by the browser build, multi-tab queries, and exports
• Results grid — virtualized scrolling and column stats
• AI assistant (optional) — bring your own provider key; messages and configured context are sent to that provider, and chat tools or saved AI context may also provide structural metadata and SQL

Remote Parquet uses the same view-based path as large local files. When the endpoint, query, statistics, and file layout support selective reads, DuckDB can request relevant portions instead of intentionally materializing the entire object up front; full scans can still transfer much of the object.

Tips and troubleshooting

Symptom	What to try
403 / Access Denied	Check bucket policy, object ACL, or IAM permissions; confirm region and key scope
CORS errors on HTTPS URLs	The bucket must allow GET from browser origins, or use presigned URLs
Wrong format detected	Set format explicitly (Parquet, CSV, JSON, etc.)
R2 / GCS signing fails	Verify endpoint host (no https:// prefix) and path-style vs vhost defaults

Compare to CLI DuckDB

If you already use DuckDB locally, the mental model is similar — read_parquet('s3://…') with a configured secret — except the data engine runs in WASM and the UI handles session credentials through the dialog instead of a .duckdbrc file. Browser, extension, filesystem, and endpoint support can differ from native DuckDB.

Try it

Open the viewer and connect your first bucket, or start with a public Parquet sample from disk to learn the SQL panel before pointing at S3.

Questions? See Support or the Parquet FAQ entry on cloud storage.