Cloudflare R2 is object storage for files like images, backups, exports, and user uploads. An object has a key, metadata, and bytes. A bucket groups objects.
Object storage is not a database. It is optimized for storing and retrieving blobs, not querying rows.
IMPORTANT
Keep private uploads private by default. Serve them through signed URLs or application authorization checks.
R2 is often paired with Workers: the Worker checks permissions, then reads or writes objects.
Further Learning
“Cloudflare R2 buckets objects” — core model
“R2 signed URLs” — private file access
“R2 Workers binding” — using R2 from Workers
R2 Object Storage
R2 is Cloudflare’s object storage — a place to store files (images, backups, user uploads) at scale. Same idea as the object storage covered in cloud-fundamentals, just Cloudflare’s version of it.
You group files into buckets, and each file has a unique key (essentially its path/name inside the bucket).
Not a database
IMPORTANT
Object storage is built for storing and fetching whole files (blobs), not for querying structured data. Don’t try to use R2 like a database — it doesn’t support searching or filtering the contents of files the way a database queries rows.
Keep private files private
By default, don’t make uploaded files publicly accessible. Instead, serve them through a signed URL (a temporary, permission-checked link) or have your app verify the request is allowed before handing over the file.
A common pairing
R2 pairs naturally with Workers: the Worker checks “is this person allowed to see this file?” and only then fetches and returns it from R2 — giving you controlled access without exposing files publicly.
In one sentence
R2 stores files in buckets under unique keys (like any object storage) — it’s for blobs, not queryable data, and private files should stay private, served through signed URLs or a Worker that checks permissions first.
Want to go deeper?
Switch to Expert mode above for signed URLs and using R2 bindings directly from Workers.