Project mkstick: make a bootable USB stick from your browser

Project mkstick makes a bootable USB stick from a web page. You pick Windows or Linux, plug in a stick and press a button, and the page writes the installer to the stick. It does the job of an app such as Rufus, and because it runs in the browser it works the same way on Windows, Mac and Linux.

The name is said "make stick". It follows the old Unix habit of naming a command after what it does, as mkdir makes a directory.

The project is new. Writing to a real USB stick through the browser has not been fully tested yet, so treat it as a preview.

Why I built it

I needed a Windows 11 installer stick and only had a Mac. The usual tools are Windows apps, and the manual way on a Mac means a terminal, an extra tool and half a dozen commands. I wanted something that anyone could open in a browser and use without installing anything.

What it can make

System	Where the installer comes from
Windows 11, for Intel, AMD and Arm PCs	Microsoft. Your browser downloads the file from Microsoft, then you choose it.
Windows 10	Microsoft, in the same way
Ubuntu Desktop and Server 24.04	Ubuntu's own server, checked against Ubuntu's published checksum
Debian network installer	Debian's own server, checked against Debian's published checksum
Anything else	An ISO file you already have

Project mkstick keeps no copies of Windows or Linux. It has no accounts, cookies or analytics.

How it works

A modern PC can start from a USB stick that simply holds the installer's files, as long as the stick is in FAT32 format. So the page does not write a raw disk image, which a browser is not allowed to do. It opens the installer's disc image, reads the list of files inside and copies each one to the stick.

Your browser                         Cloudflare Worker            Others
  reads the disc image   -- list --> catalogue        ---------> Ubuntu, Debian
  splits the big file    -- piece -> pass-through     ---------> Ubuntu, Debian
  writes to the stick    -- link --> stored links <-- GitHub job --> Microsoft

Four parts do the work in the browser:

• Two disc readers. Windows images use a format called UDF and Linux images use ISO 9660, so there is a small reader for each.
• A splitter. Windows ships one file, install.wim, that is larger than FAT32 allows. The page splits it into parts that Windows Setup puts back together by itself. It moves the compressed pieces as they are, so nothing has to be unpacked and little memory is needed.
• A checksum. A Linux image is hashed while it is written and compared with the checksum its publisher prints.
• A writer. Chrome and Edge let a page save files into a folder you pick. The page uses that to write to the stick, and it can carry on from the last finished file if something interrupts it.

Linux images are read from their publishers in pieces. Their servers do not let a web page read files directly, so a Cloudflare Worker fetches each piece and passes it on without keeping it.

Windows downloads

Microsoft does not allow other sites to hand out Windows, so the file always travels from Microsoft to your browser. What the page can do is save you a visit to Microsoft's download page, by holding the same time-limited link that page would give you.

Getting those links took some testing. Microsoft rejects the request when it comes from Cloudflare's network and accepts it from GitHub's. It also answers about eight requests for one Windows version from one address, then refuses the rest for a while. So a scheduled GitHub job fetches the links every six hours, in eight languages for each version, and hands them to the site. If your language is not one of the eight, the page shows how to get the file from Microsoft yourself.

Security

• It cannot wipe a drive. A web page has no way to format or erase a disk. The page only adds files to the folder you pick, and it refuses a folder that already has things in it.
• Your file stays with you. The installer you choose is read on your own computer and is never uploaded.
• Nothing runs from other sites. A strict content policy allows scripts, styles and fonts from the site itself only, and the page cannot be shown inside another site.
• Disc images are not trusted. File names with .. or characters FAT32 forbids are left out, and listings have upper limits, so a hostile image cannot write outside the stick or exhaust the browser.
• Windows links are checked three times. A link must be an https address on microsoft.com when it is stored, when it is served and before the page follows it.
• Only the job can store links. The route that accepts them needs a secret and has its own rate limit.
• The pass-through is narrow. It reaches Ubuntu's and Debian's servers only, serves pieces of .iso files only and answers the project's own page only.

A test script in the repository runs about 45 checks against the live site. No site can be proved unhackable, and the things outside the project's control are listed in its security notes.

What has been tested

Test	Result
A 9 GB Windows 11 image through the engine	979 files written. The split parts pass wimlib's own check.
The Windows 11 stick image in a virtual PC	Setup starts and lists every edition, so it reads the split file.
Debian and Ubuntu Server stick images in a virtual PC	Both reach their installers, and both checksums match.
Debian on the live site, into a test folder	1,073 files in about 35 seconds, with a matching checksum
The security checks	All pass

Limits

• It needs Chrome or Edge on a computer. Safari, Firefox and phone browsers do not let a page write to a drive.
• The stick has to be empty and already in FAT32 format. The page shows how to format it on Windows, Mac and Linux.
• The sticks start PCs that use UEFI, which leaves out some machines from before 2012.
• It cannot make Mac installers.

Technology

Part	Technology	What it does
Page	Plain HTML, CSS and JavaScript	The four steps, with no framework and no build step
Writing to the stick	File System Access API	Saves files into the folder you pick
Checksum	hash-wasm	SHA-256 of the image as it is written
Server	Cloudflare Workers	The catalogue, the pass-through, stored links and security headers
Link storage	Workers KV	Keeps Windows links for 23 hours
Link job	GitHub Actions	Fetches fresh Windows links every six hours

Open source

The code is on GitHub under the MIT licence. The repository has the full technical documentation, the security notes and the test scripts. Bug reports and fixes are welcome.

If Project mkstick helps you, post your stick on Instagram, tag @conanzhangtech and add #projectmkstickbycztsh.