Secure file transfer, explained and free

What makes a file transfer secure?

Security is not one feature but a set of answers to specific risks: someone intercepting the upload, someone finding the link, a file staying online long after it was needed, or the service itself being able to read your data. A secure transfer covers each of them. Here is how Transfr maps protections to risks.

How to send files securely with Transfr

1. 1

   Step 1

   Add your files

   Open Transfr and drop the files or folders, up to 100 GB per transfer on the free plan.

2. 2

   Step 2

   Turn on end-to-end encryption

   Switch it on in the transfer options. Your browser encrypts every file before the upload starts, so only encrypted data reaches our servers.

3. 3

   Step 3

   Add a password and limits

   Set a password, a short expiry (1 day is often enough) and, for one recipient, a download limit of 1 or 2.

4. 4

   Step 4

   Share the link and the password separately

   Send the link by email or chat, and the password by another channel, such as a phone call or a text message. Anyone who intercepts one still lacks the other.

How does end-to-end encryption work on Transfr?

With end-to-end encryption (E2EE) on, your browser generates a random secret key and encrypts each file with AES-GCM before uploading it. The key is placed in the part of the link after the # sign, which browsers do not send when they open a page, and Transfr never stores it. What we store is encrypted data that cannot be read without that key: file contents, but also file names, the transfer title and your message.

When your recipient opens the full link, their browser reads the key and decrypts the files locally. If you add a password, it is combined with the key, so the link alone is not enough. The design is based on Mozilla’s open-source Send project. Read the full explanation in end-to-end encrypted file transfer.

E2EE has a few trade-offs: folders are sent as a flat list of files, large previews are limited, and an interrupted upload cannot resume. For most confidential documents these do not matter; for a 90 GB video master, a password and a short expiry may be the more practical choice.

Is email secure enough for sensitive files?

Usually not. Attachments sit in the sender’s and every recipient’s mailbox indefinitely, are copied to each device that syncs the account, and can be forwarded with one click. They also stop at 20 to 35 MB on mainstream providers as of October 2026. A transfer link gives you what email cannot: an expiry date, a download limit, a password and the option to delete the files early.

When SFTP is the better choice

SFTP (file transfer over SSH) is the standard for automated, recurring exchanges between systems, such as a nightly export to a bank or a supplier. It needs a server, accounts and keys to manage. For people sending files to other people, a web transfer covers the same basics (encryption in transit, controlled access) and adds end-to-end encryption and automatic deletion, without any of that set-up.

Where are my files stored?

By default, Transfr stores transfers in Western Europe. When you create a transfer, you can choose another region (Eastern Europe, North America East or West, Asia-Pacific or Oceania) to bring the files closer to your recipient. Files are deleted from storage after the transfer expires, during a daily clean-up.

For organisations working under the GDPR, keeping files in Europe, deleting them automatically and using end-to-end encryption all reduce exposure. Our guide to GDPR-compliant file transfer goes through the practical points.

Secure file transfer checklist

• Turn on end-to-end encryption for anything personal, legal, medical or financial.
• Add a password and send it through a different channel than the link.
• Choose the shortest expiry that works for the recipient.
• Set a download limit when you send to one person.
• Use a free account with two-factor authentication if you send often, so you can delete a transfer early.
• Check the address before sending by email: up to 10 recipients get the link directly.

More detail in the secure file transfer checklist and share link expiry and passwords.

Secure transfers for professionals

Law firms, accountants and HR teams send sensitive files every day. Transfr Pro adds download tracking, so you know when a document was opened, and your own domain on the download page, which helps recipients trust the link. See secure file transfer for law firms, and if you need to collect documents rather than send them, receive files with a password-protected request link.