How to send files securely

Before any recommendation: secure means three different things, and which one you need depends on who you are worried about. Encryption in transit is something every service has today, so it is not a reason to choose one. Encryption at rest protects the file if someone gets into the provider's servers. End-to-end encryption goes further and protects it from the provider as well. The third is the strongest, and the only one with a real cost, which we explain below.

The three levels

For most situations, the first two are enough

A contract, a quote, a photo delivery, a rough cut: here the real risk is not that the provider reads your files, but that the link ends up somewhere it should not. Encryption at rest plus a short expiry deals with that, and you can still copy the link again from your transfers if you close the tab by accident.

Going too far the other way has a price. End-to-end encryption means the key exists nowhere except on the two devices, so if it is lost, the file is gone for good, for everyone, you included.

When you really need end-to-end

When the content is the problem, not the access: medical data, legal documents, research material, anything you have signed an agreement not to let out of your hands. In those cases the mere fact that the provider could read the file is unacceptable, whether it does or not.

What we offer, and where the limits are

Instant transfer, peer-to-peer, is end-to-end encrypted by design: the file travels straight between the two browsers and is never stored on our servers. Instant is free up to 5 GB on the free plan; above that, any paid plan unlocks any size. The condition is that your tab stays open until the recipient has finished downloading.

A hosted link is encrypted on your device with AES-256-GCM before upload and stays encrypted in storage. By default we keep the key, wrapped by a cloud key management service, so you can copy the link again from your transfers if you lose the original tab. With Zero-Knowledge mode, available on the Premium plan, the key never reaches us: we cannot read the file, and we cannot recover it for you either. The choice is yours, and it cuts both ways. Zero-Knowledge works on links you share yourself; when Transferify emails the transfer to your recipients, delivery uses keys the server manages, so the two do not combine.

What depends on you, not on the encryption

Three things decide the fate of a file more often than the encryption algorithm:

• Who you send the link to. A forwarded link is a public link, however well the file behind it is encrypted.
• How long it stays valid. Pick the shortest window the recipient needs, not the longest one available.
• Which channel carries it. A link posted in a team chat channel is visible to the whole channel, now and later.

From the Basic plan you can also put a password on the link; send it over a different channel from the link itself. For PDFs, contracts and scans, the steps are in the guide on sending documents: how to check the file set, share the password separately, and why a download does not prove the document was read.

When a transfer service is not the answer

Premium includes legal hold for transfers set to never expire: while the hold is on, the files are kept until you release it, and deleting the transfer is blocked. For broader compliance needs, such as an audit log, document classification and data loss prevention, the business platform you already use is the right tool for material that stays inside the organisation. A transfer service is for what leaves it, going to someone who has no account with you and will not get one.

If you weigh a shared folder in the tools your organisation already pays for, see how Transferify compares with Google Drive and OneDrive on sharing outside the organisation.

How to send securely, in four steps

1. Open Transferify and add your files. The encryption happens on your device, before anything uploads.
2. Choose Direct, the instant transfer, for end-to-end encryption, or Hosted with Zero-Knowledge, available on the Premium plan, if even we should not be able to read the file.
3. Set the shortest expiry the recipient needs.
4. If you are not signed in yet, confirm your email address with a one-time code. You do not choose a password. Then send the link.

The expiry windows and download allowances of each plan are on the pricing page. If what you mainly care about is what each service asks of you at sign-up, see also the guide on sending large files without an account.

Step three deserves its own read, because the expiry is half the control you have over a link. How long it can last, what can be extended, and what the recipient sees afterwards are in the guide on how long a transfer link lasts. For the other ways to send, start with the overview of how to send large files.

Send your files encrypted. The encryption happens in your browser before anything leaves your device.