How to send large files securely
Four controls do almost all the work, in this order: send a link rather than an attachment, set an expiry, add a password sent through a different channel, and be able to revoke it. Encryption matters, but it is not what prevents most real incidents — a link that still works two years later is a far more likely cause of a leak than anyone breaking cryptography.
Why links beat attachments
An emailed attachment is a copy you can never take back. It sits in the recipient's mailbox indefinitely, gets forwarded, and is backed up by systems you have no visibility into. If you later discover you sent the wrong version, or to the wrong person, there is nothing you can do.
A link is revocable. That single property is the reason to prefer it for anything sensitive, independent of size.
The four controls, in order of usefulness
1. Expiry
The most valuable control and the most neglected. A delivery link that works forever is a credential sitting in an inbox, waiting to be found in a breach of their mail provider rather than yours.
Set the shortest period that is actually practical. For a one-off document, a week. For a client deliverable they will revisit, longer — but chosen, not defaulted. Retention is a decision worth making deliberately.
2. Revocation
Ask specifically whether a service lets you kill a link after sending. People assume it exists; it often does not.
This is what turns "I sent that to the wrong address" from an incident into an inconvenience.
3. A password, sent separately
Useful precisely when the email might be forwarded or the mailbox compromised.
It is worth nothing if you put the password in the same email as the link, which is what most people do. Send it by text, or say it on a call. Ten seconds, and it is the difference between two factors and one.
4. Download limits
A one-time link, or a cap on downloads, is a good fit for genuinely sensitive single documents. It also tells you if something is wrong — if a one-time link was already used before your recipient tried it, you have learned something important.
Where encryption actually fits
Almost every service encrypts in transit and at rest. Those are table stakes and not a differentiator.
The question that separates them is who holds the key, and there are two honest answers:
The service holds it. This is the normal design. It is what allows previews, search and virus scanning. For most work it is the right trade, and calling it insecure would be wrong.
Only you hold it. End-to-end encryption. The service cannot read your file even if compelled. Stronger, and it costs you features — no previews, no scanning, and if you lose the key the file is gone permanently.
The fastest test of which you are being sold: can the service show a thumbnail of your file, or recover it if you forget your password? If yes, it holds the key. That is not a scandal, but it means "end-to-end" would be the wrong word. The longer version is worth reading if a vendor is claiming the stronger property.
Pick based on your actual threat model. If the risk you are managing is "the wrong person gets the link", encryption is not the control that helps — expiry and revocation are.
When the file contains other people's data
Once the file has personal data in it — client records, photographs of identifiable people, anything medical, legal or financial — the technical controls above are necessary but no longer sufficient. You also need to know:
- Where the files are stored, and which country's courts can compel the provider to produce them. Those are two different questions.
- Whether you have a data processing agreement with the service. If a vendor cannot produce one, it is not usable for this.
- How long the data is kept, and whether you control that.
What the GDPR actually requires covers this properly, and sending sensitive client data covers the special-category cases where the obligations get sharper.
What to check when comparing services
Skip the marketing word "secure" and ask five things:
- Can I set an expiry, and what is the shortest and longest?
- Can I revoke a link after sending it?
- Can I password-protect a transfer?
- Can I limit the number of downloads?
- Can you produce a data processing agreement?
Every serious service answers these in a minute. The secure-services comparison goes through the categories in more detail.
The habits that matter more than the tool
Send the least you can. Cull the folder. A file you did not send cannot leak.
Never reuse a link for a second recipient. You lose the ability to reason about who has what.
Check what you actually shared. Download your own link from a signed-out browser once. This catches over-sharing, and it catches the delivery being unreachable when you thought it was fine.
Review old shares occasionally. Most people have folders shared as "anyone with the link" from years ago. That five-minute audit is worth more than any product upgrade on this page.