Password · Expiry · Burn after read
Password-protected temporary file sharing
Add a password to any drop and the link alone is no longer enough to open it. Pair it with a short expiry or burn-after-read for files that should not linger.
Have a code already?
Limits — 25 MB per file · 100 MB per drop · 25 files
Step by step
How to send a password-protected file
- 01
Add the file
Drag it in or tap Browse files.
- 02
Set a password
Type one into the Password field under the files, and pick how long the drop lasts from Deletes itself while you are there.
- 03
Create the drop
Press Create drop. The link now asks for the password before it shows anything.
- 04
Send the link and the password separately
The link in one message, the password through a different channel — a call, or another app.
What the password does
- It gates access: without it, the link shows a lock screen and nothing else.
- It is never stored as you typed it — only as an scrypt hash with a random salt for each drop, compared in constant time.
- It can be changed or removed later from the drop’s page.
What the password does not do
It does not encrypt the file. Content is stored in a form the server can read, and the password decides who may open the drop, not whether the operator could. That is deliberate — it is what lets a plain link work on any device — but it should decide what you send.
If the storage operator reading a file would be a problem, encrypt it before uploading — for example, a ZIP archive with AES-256 encryption made in 7-Zip, with the password sent separately — or use a service built around end-to-end encryption.
Habits that make it work
- Send the password through a different channel from the link, so one intercepted message is not enough.
- Set the shortest expiry that does the job.
- Turn on burn-after-read for anything meant to be opened once.
- Use a password made for this drop, not one you use anywhere else.
FAQ
Password-protected sharing — common questions
Is password-protected file transfer secure?
It stops anyone who only has the link. Transfers run over HTTPS and passwords are stored as salted scrypt hashes. It is not end-to-end encrypted, so treat it as access control rather than as secrecy from the server.
Can you see my files?
Technically, yes — the server stores content in a readable form, and we say so rather than imply otherwise. For material that must stay unreadable to anyone but the recipient, encrypt it before uploading or use an end-to-end encrypted service.
What if the recipient forgets the password?
There is no recovery, because the password itself is never stored. You can set a new one from the drop’s page, or create a new drop.
Related
More ways to move a file
- Temporary file sharingLinks that expire, and files that are deleted when they do.
- Send files by linkTurn a file into a short link you can paste anywhere.
- Send without loginNo account to create — for you or for the person receiving.
- WeTransfer alternativeFor small, quick transfers — and when WeTransfer is still better.