How to Share Files Securely: Passwords, Expiry and Threat Models
A transparent look at how link tokens, password challenges, malware quarantine, and short-lived presigned URLs protect your transfers.
Defense in depth for link-based file sharing
A secure transfer link relies on four layers: (1) high-entropy unguessable tokens generated via CSPRNG and stored only as keyed cryptographic hashes on the server, (2) optional password challenges protected against brute force, (3) mandatory server-side malware scanning before activation, and (4) automatic expiration that deletes underlying storage objects.
When sharing confidential documents, always enable a transfer password and communicate the password over a separate channel (such as SMS, Signal, or phone) from the email containing the link.
Why fail-closed quarantine scanning matters
A file transfer service must never trust a browser's claim that an upload is benign or complete. Every uploaded object should land in a private quarantine bucket where the server independently verifies the byte size and runs an isolated malware scan before issuing any share token.
On recipient pages, strict 'noindex, nofollow' headers ensure shared links are never indexed by search engines.
Try Attach & Send free
Upload up to 2 GB with password protection and 3-day link expiry — no account needed.