Password protected file transfer

What does password protection do?

A download link is like a key left under the doormat: anyone who finds it gets in. Links are forwarded, pasted in the wrong chat, kept in old email threads or previewed by tools that scan messages. A password adds a second thing the visitor has to know, so the link alone is not enough. It is the simplest protection to add, and the one recipients understand without explanation: they open the link, type the word you gave them, and get their files.

On Transfr, a protected transfer shows only a password field. The file list, file names, sizes, previews and comments stay hidden until the right password is entered, and downloads are refused without it. The check happens on our servers, not just on the page, so it cannot be bypassed by calling the download address directly.

How to send files with a password

1. 1

   Step 1

   Add your files

   Open Transfr and drop files or folders, up to 100 GB per transfer on the free plan.

2. 2

   Step 2

   Type a password

   In the transfer options, enter the password your recipient will need. Use a passphrase of a few unrelated words rather than a short word.

3. 3

   Step 3

   Send the link

   Copy the link or let Transfr email it to up to 10 people.

4. 4

   Step 4

   Share the password separately

   Tell your recipient the password by phone, text message or another chat. Never put it in the same email as the link.

How Transfr stores and checks your password

• Never stored in clear. Transfr keeps only a bcrypt hash of the password, a one-way fingerprint that cannot be turned back into the password.
• Checked server-side. The file list and every download require a valid check first, so the protection does not depend on the page you see.
• Guessing is slowed down. Password attempts are rate-limited per IP address, which makes trying passwords one after another impractical.
• Remembered for the visit. Once a recipient has entered it, they can browse and download the transfer without typing it again during that visit.

Password or end-to-end encryption: which do you need?

They protect against different things, and they combine well.

When you use both, Transfr derives the decryption key from the secret in the link and your password, in the browser. The link alone does not decrypt anything, and the password alone does not either. For contracts, health or financial files, this is the combination to use. Read more about end-to-end encrypted file transfer.

Protected transfer, protected ZIP or protected PDF?

You can also put a password on the file itself: an encrypted ZIP or 7z archive, or a PDF with an open password. The difference is where the protection lives.

• A protected file stays protected wherever it goes, even after download, but the recipient needs a compatible app, and some email services block encrypted archives.
• A protected transfer controls access to the delivery: nothing is visible or downloadable without the password, and the link expires. Once downloaded, the file is a normal file.

For most deliveries a protected transfer is enough and easier for the recipient. For documents that must stay locked after download, protect the file as well and send it through a protected transfer. See sending a large ZIP file and sending a large PDF.

Good practice for password-protected transfers

• Use a different channel for the password: if the email is intercepted, the password is not in it.
• Pick a passphrase, such as four random words. It is easier to dictate over the phone and harder to guess than a short word with symbols.
• Do not reuse a password you use for an account.
• Add an expiry and a download limit. A password protects access; an expiry makes sure the files do not stay online longer than needed. Free transfers last 1 to 7 days.
• Delete early when done. With a free account, you can delete a transfer as soon as the recipient has the files.

For a complete approach, see secure file transfer and our article on share link expiry and passwords.

Password-protect a file request link too

When you collect files from others, a public upload link could receive unwanted files. Add a password to your file request and only people who know it can upload. Combine it with a closing date and a maximum number of submissions. See receiving large files.

Who uses password-protected transfers?

• Law firms and accountants sending contracts, statements and identity documents: see secure file transfer for law firms.
• Photographers and studios delivering unpublished work: see sending RAW photos.
• Musicians and labels sharing unreleased tracks: see sending audio files.
• HR teams exchanging payslips and contracts that should never sit in an inbox unprotected.