Secure File Sharing: Permissions, Passwords, and Expiry

Cybersecurity & Privacy / Practical file-sharing guide

For a file intended for named recipients, start with restricted sharing, grant only the role they need, and review every existing route to the file. Use passwords and expiry where appropriate and supported, but do not assume either replaces recipient restrictions. Test the link from the recipient’s perspective, then remove access when the work ends.

A long, unfamiliar URL is not itself a privacy setting. Nor does “view only” necessarily mean the reader cannot save a copy. The useful questions are who can open the item, what they can do, how they gained access, and when that access should stop.

01 / Choose who can open the link

Decide whether the document is public, available to a broad internal audience, or restricted to particular people. Make that decision before copying the URL.

Microsoft’s sharing-link documentation distinguishes Anyone, people-in-your-organization, and Specific people links. Anyone links can be passed on; Specific people links require the recipient to authenticate as someone specified by the sender. An internal organization link is also a different audience from a short list of colleagues.

For Google Drive, Google’s sharing guide distinguishes restricted access from Anyone with the link. In a work or school account, administrative policies can limit the choices. If an option is unavailable, ask the owner or administrator which approved method fits the task rather than weakening access somewhere else.

Recipient restrictions control access through the service; they do not guarantee that an authorized reader will keep the content confidential. Share only what the task requires, especially when the original folder includes unrelated material.

02 / Separate viewing, commenting, and editing

Ask what the recipient needs to accomplish. Reading a final PDF, leaving feedback, and changing a working spreadsheet are different jobs. Start with the narrowest role that supports the job and increase it deliberately if needed.

Google’s access-management documentation explains Viewer, Commenter, and Editor roles. For folders, editing can include adding, moving, or deleting files, so granting folder-wide editing deserves a broader review than allowing feedback on one document.

Check whether editors can change sharing permissions. A collaboration role can affect both the contents and the audience. If you need feedback only, a commenting role may be more appropriate than allowing changes to the original.

Also decide whether the recipient needs a downloaded deliverable or access to a continuously updated original. A download creates a separate copy. A link to the original can show later edits, which may be useful for collaboration but inappropriate for a fixed final handoff.

03 / Use passwords and expiry for their actual purpose

A password adds a shared secret

A password-protected link requires an additional secret to open it. It does not, by itself, prove that the person entering the secret is the intended recipient: the link and password can both be forwarded.

Use a unique password for the delivery rather than reusing an account password. Send it through a separately agreed channel when practical. If the same person receives both the link and password in a forwarded message, that separation has provided little benefit.

Expiry limits an access window

Choose an end date based on the task and communicate it clearly. For people in different countries, include the relevant time zone or a written deadline so “Friday” does not become an ambiguous access promise.

Dropbox’s shared-link documentation lists passwords and expiry among features available on specified paid plans, including Professional, Essentials, Standard, Advanced, Business, Business Plus, and Enterprise. Confirm the feature in your actual account before promising it. Other providers and account types have different controls.

Expiry affects future access through the expiring route. It does not recall a file already downloaded, remove an emailed attachment, or automatically settle a recipient’s retention obligations. If the file must remain available as a final deliverable, agree that separately from access to the working copy.

Download restrictions reduce a particular option

Dropbox also cautions that disabling downloads through a shared link does not prevent saving content by other methods. Treat preview-only controls as one layer, not a guarantee against copying. Check that the file format can actually be previewed in the intended workflow.

04 / Check direct and inherited access

Before trusting a new link’s settings, inspect the file’s full access list. A person may already have permission through a direct invitation, group, team, parent folder, or site. Changing one link need not remove those other permissions.

Microsoft’s permission-management guide distinguishes sharing links from direct access and explains that inherited permissions may need to be changed at the parent folder or site. Dropbox likewise says its link restrictions do not alter permissions held by people already added directly.

For Drive, Google documents folder inheritance: higher access from a parent folder cannot simply be reduced by choosing a lower role on an individual file. Review the location and inherited audience before creating the share.

Do not casually remove a group or folder permission to fix one document; that may disrupt unrelated work. Consider an appropriately controlled delivery location, then verify the resulting permissions. Moving or copying an item can have service-specific effects, so inspect the result rather than assuming it becomes private.

05 / Run a short access test

Testing the link while signed in as its owner mostly proves that the owner can open it. Use a harmless test file to rehearse the method first, then verify the real delivery without disclosing it to an unauthorized tester.

A private window is useful for checking anonymous access, but it does not simulate every recipient. Existing group access, guest sign-in, organizational policy, and already downloaded copies are separate issues.

• Confirm that the URL opens the intended version, not a similarly named file.
• Check the recipient’s exact address and the account they are using.
• Try the required action: view, comment, edit, or download.
• Inspect parent-folder access and other active sharing routes.
• Record the owner and date for the closing review.

If an invited person gets an access error, first check their identity and the saved invitation. Do not immediately change the link to Anyone just to remove the sign-in step.

06 / Close access when the work ends

At the agreed deadline, review the item’s access panel again. Remove or expire the intended links, direct invitations, or other grants using the provider’s supported controls. Then check whether a group or parent still gives the former collaborator access.

Keep a minimal record: item, purpose, owner, recipient group, role, and review date. You do not need to copy sensitive file contents into a sharing register. For repeat work, assign someone responsibility for checking old project folders.

Revocation is not remote deletion of copies already saved elsewhere. If a link was sent to the wrong person, restrict the exposed route promptly, establish which file and permissions were involved, and follow your organization’s response process. Do not promise that changing a password or deleting a link has undone prior disclosure.

Protect the owner account too. A carefully restricted share still depends on the accounts managing it. Our passkeys versus authenticator apps guide covers sign-in and recovery choices as a separate account-security decision.

07 / Apply the process to a client handoff

Hypothetical example: a freelance designer needs feedback from two client contacts for one week. The working folder also contains other customers’ drafts.

The designer prepares a delivery location containing only the relevant material, invites the two agreed addresses with the required feedback role, and checks for inherited access. They verify the recipient journey using a harmless sample, then confirm the real file with the client. The message states what feedback is needed and when working access will be reviewed.

At the end of the week, the designer closes the temporary collaboration access and separately delivers the agreed final files. The important choices are the limited material, named audience, suitable role, and explicit closing step. A password alone would not resolve the original problem of a folder containing unrelated client work.

Use the same pattern for a job application, a supplier review, or a small team project. Adjust the service and controls to the data and organization’s requirements, and check features before paying for an upgrade.

Frequently asked questions