Expiring share links and passwords: how to protect what you share

An expiring share link stops working after a date you choose, so files are reachable only for as long as the recipient needs them. Combined with a password sent through a separate channel and, where possible, a download limit, it turns a link that anyone could forward into access that is limited in time, in people and in uses.

Most sharing accidents are not hacks. They are old links: a folder shared “with anyone who has the link” years ago, a delivery link forwarded by a client to a colleague, a URL pasted in a public channel. This guide explains how to choose expiry dates, passwords and download limits, with the current official password guidance, and what to do when a link has gone where it should not.

Why links should expire

• Links travel. Emails are forwarded, chats are screenshotted, project tools are shared with new people.
• People forget. Nobody audits the shares they created three years ago.
• Data protection asks for it. The GDPR’s storage limitation principle (Article 5(1)(e)) says personal data should be kept no longer than necessary; a link that expires when the job is done is the simplest way to apply it. See our GDPR file transfer guide.
• Less exposure. If a link leaks after it has expired, it leads nowhere.

How long should a share link last?

On Transfr, the free plan lets you choose 1, 3, 5 or 7 days; Pro adds 15, 30 and 60 days. If you are signed in, you can change the expiry after sending, for example to extend it for a client who was on holiday.

What makes a good link password?

The US National Institute of Standards and Technology updated its digital identity guidelines in July 2025 (SP 800-63B-4). Its rules for passwords are a useful reference for link passwords too:

• Length beats complexity: NIST requires at least 15 characters for a password used on its own, and forbids imposing composition rules such as “one symbol and one capital letter”.
• Avoid common or breached passwords: services should check new passwords against lists of commonly used and compromised ones.
• No forced periodic changes, only a change when there is evidence of compromise.
• Password managers and paste should be allowed, so long random passwords are practical.

The UK’s National Cyber Security Centre suggests a simple method for something memorable: combine three random words, which gives a password that is “long enough and strong enough”, and notes that swapping letters for symbols (o for 0) does not make it meaningfully stronger. For a link password you will paste anyway, a long random string from a password manager is even better.

Download limits: closing the door after use

A download limit makes a link stop working after a set number of downloads. Set it to the number of people who should receive the files, perhaps plus one for a retry, and a forwarded link quickly becomes useless. On Transfr, download limits are free, can be set from 1 to 1,000 or left unlimited, and can be edited after sending.

Password, expiry, download limit or end-to-end encryption?

The layers add up. For routine deliveries, an expiry date is enough. For personal or confidential data, combine a short expiry, a password, a download limit and end-to-end encryption. All four are available on Transfr’s free plan.

Expiry and passwords on popular services

The pattern is clear: transfer services expire by default, cloud storage does not. If you share from Google Drive, OneDrive or Dropbox, put a reminder in your calendar to remove access, or use a transfer for one-off deliveries. Our comparison of Google Drive and file transfer services and the best free file transfer services go further.

Expiring links for files you receive

The same logic applies to collecting files. A file request link that stays open forever can keep receiving uploads long after a project ended, sometimes from people you did not intend. Give requests an end date or a maximum number of submissions, and a password if the documents are sensitive. See how to receive files from clients.

How to set it up on Transfr

1. 1

   Step 1

   Add your files

   Open Transfr and add files or folders, up to 100 GB per transfer for free.

2. 2

   Step 2

   Open the transfer settings

   Choose the expiry (1 to 7 days on free, up to 60 days on Pro).

3. 3

   Step 3

   Add a password

   Use a long passphrase or a random password from your password manager.

4. 4

   Step 4

   Set a download limit

   Match it to the number of recipients.

5. 5

   Step 5

   Send, then share the password separately

   Send the link by email or copy it, and give the password through another channel.

A link went to the wrong person: what now?

1. Revoke access immediately: delete the transfer, shorten its expiry or change its password. On Transfr, signed-in senders can do this from their dashboard.
2. Check the downloads: if you had notifications or Send & Track on, see whether the files were downloaded and when.
3. Assess the content: if personal data was exposed, your organisation may have obligations under the GDPR, including notifying the authority within 72 hours when there is a risk to people (Article 33).
4. Send a fresh link to the right person, with a password this time.

Watch out for fake “file shared with you” emails

Attackers imitate file-sharing notifications to steal passwords: CISA and the UK’s NCSC have documented campaigns that used links on well-known file-sharing platforms leading to fake sign-in pages. A genuine transfer link should not ask you to sign in with your email password. When in doubt, confirm with the sender through another channel. Our secure file transfer checklist covers this and other habits.