Access control
Password protect a file before you send it
A link is a key, and keys get forwarded. Adding a password splits the secret in two: the link travels by email and the password goes another way, so an intercepted message is not enough on its own to open the file.
- One password per link
- Sent on a second channel
- Cap the downloads
- Preview-only links
Why a link on its own is not access control
Anyone who sees the URL can use it. Links get forwarded, quoted in replies, pasted into group chats, and logged by whichever service carried the message. Sending something sensitive as an unprotected link assumes none of that will ever happen.
A password changes the failure mode. Instead of one secret that leaks in one place, there are two pieces of information travelling separately. Someone holding only the link has nothing they can use.
How the password works
You set the password when you create the link, or add one afterwards from the dashboard. Someone opening the link is asked for it before the file is released — the check happens before the download starts, not after.
The decision stays reversible. You can set a new password, remove it, or revoke the link entirely at any point.
Send the password by a different route
The protection is only as strong as where the password travels. Emailing the link and then replying with the password puts both halves in the same mailbox, which defeats the point.
Use a second channel: the link by email, the password by message or over the phone. It costs one extra step and it is the entire reason the password is worth having.
Pick something better than a guess. The strength of the protection is the strength of the password, so a project name with the year on the end is barely better than no password at all.
Stack it with the other controls
Password protection composes with everything else here. A download limit stops one link being passed around a group; an expiry date means the file stops being reachable at all.
A referrer restriction stops other websites embedding the link, which blocks the classic case of a private file being quietly republished as a download page somewhere else.
For material that should be read and not kept, a preview-only link opens the file in the browser without offering a download at all.
Questions
- How do I add a password to a file link?
- Set it when you create the link, or add one later from the dashboard. The recipient is asked for it before the file is released.
- Where should I send the password?
- Anywhere except the same channel as the link. The link by email and the password by message or phone is the pattern that actually holds up.
- Does the password encrypt the file?
- The password gates who can unlock the link, not the bytes at rest. Treat it as access control for the link rather than end-to-end encryption of the contents.
- Can someone guess the password?
- Only if it is guessable. There is no account password to fall back on and no reset flow, so choose something long and unrelated to the file name.
- Can I remove the password later?
- Yes. Passwords, expiry dates and download limits can all be changed or removed from the dashboard after the file is uploaded.
- Can I password protect a preview link?
- Yes. Password protection applies to preview links as well as download links.
Keep reading
Send a file with a link you control
No account, no install, and a link that expires when you decide it should.
Upload a file