Encrypted File Sharing: How to Send Files Securely

What encrypted file sharing protects, and what it does not

Most services say they encrypt files, but the word covers three different protections. Each answers a different question about who could read the file, so ask which ones a service actually provides.

In transit: the file is encrypted while it travels, usually with TLS (the padlock in your browser). People on the network cannot read it, but the service receives a readable file.
At rest: the service stores the file encrypted. A stolen disk or backup is useless without the key, but the service, which holds that key, can still decrypt it.
End-to-end: the file is encrypted on the sender's device and only the recipient can decrypt it. The service passes along data it cannot read.

The FTC's Start with Security guide tells businesses to use strong cryptography for confidential material in storage and in transmission. It also notes that encryption fails when it is misconfigured, for example when certificate validation is turned off.

Who holds the keys in encrypted file sharing

Encryption turns "who can read this file?" into "who holds the key?" If the provider keeps the keys, its systems can decrypt your files, and so could anyone who breaks in or obtains a legal order for the data. If only the sender and recipient hold them, the provider has nothing readable to hand over. NIST covers the topic in its key management recommendation.

Ask any provider:

Who generates the keys, where are they stored, and can the provider's staff or software decrypt a file?
Are file names and sizes encrypted too, or only the contents?
What happens if you lose the password or key? With true end-to-end encryption, there is often no recovery.
How is a key replaced if it leaks?

When you need end-to-end encrypted file sharing: when nobody but the two ends should be able to read the file, including the provider. The trade-off is that the service usually cannot preview or scan the content, and a lost key can mean a lost file. For everyday working files, encryption in transit and at rest with good access controls is often enough.

Password-protected links: send the password another way

A link alone should not be the key to your document. Links get forwarded, pasted into the wrong chat and saved in browser histories. A link password adds a second piece the reader must have.

Turn on the link password. Use the one the service generates, or make it long and random; CISA recommends at least 16 characters or a passphrase of unrelated words.
Send the link by email or through the channel the recipient expects.
Send the password another way: a phone call, a text message or in person. Never put it in the same email or thread.
Tell the recipient when the link expires.
Once they confirm they have the file, let the link expire or delete the share.

The second channel matters because one compromised mailbox or forwarded message would otherwise carry both halves. Fake "a file was shared with you" emails are also used for phishing, and the FTC advises businesses to independently verify emails that ask for sensitive information.

Link expiry, download limits and access logs

Good controls limit how long and how often a file can be collected, and they record what happened.

Expiry: choose the shortest lifetime that works, such as a day or a week, not "forever".
Download or open limits: one recipient who needs one copy needs one or two downloads, not unlimited ones.
Early cancellation: ask whether a link can be revoked after it is sent. Some services cannot do this; deleting the file is then the only way to stop it.
Access logs: opens, downloads and failed password attempts should be recorded with times, so you know whether the file was collected.
Recipients without accounts: account-based access ties a download to a person; account-free links are easier but rely on the link and password alone.

Check default sharing settings too. In Google Drive, "Anyone with the link" lets anyone holding the link open the file without signing in, while "Restricted" limits it to people you added.

How to send large files securely

Email is a poor fit for big files. Gmail caps attachments for personal accounts at 25 MB and swaps a larger file for a Google Drive link, so that link's sharing settings now matter more than the email.

Use a service whose limits fit. Check the per-file size limit and how long files are kept before you upload; both vary widely between services.
Encrypt the file yourself. A free, open-source archiver such as 7-Zip supports AES-256 encryption in the 7z and ZIP formats. Send the archive one way and the password another, and keep sensitive details out of file names, which some formats leave readable.
Split very large sets into several encrypted archives, or ask the recipient's IT team for a managed upload location.

What to check before choosing a secure file sharing service

Ask for written answers, not adjectives:

Keys: who holds them, whether the service is end-to-end encrypted, and whether file names and other metadata are protected.
Accounts: support for multifactor authentication and separate administrator and member roles.
Links: passwords, expiry, open limits and whether a link can be revoked.
Logs: what is recorded, for how long, and how you get a copy.
Deletion: what "delete" removes and how long copies remain in backups.
Location: the country or region where data is stored, which other companies process it, and how you get it back if you leave.
Outside recipients: how someone without an account receives a file and what they see before entering a password.
Limits: file size, number of files and retention.

Common mistakes when sharing sensitive files

Emailing sensitive attachments. The FTC's guide for businesses says regular email is not a secure way to send sensitive data. Copies linger in mailboxes and can be forwarded. In Gmail, a red open lock means a message was not encrypted.
Public links that never expire. An "anyone with the link" share made years ago may still work. Review old shares and turn them off.
The password in the same message. A link and its password in one email protect little more than no password at all.
Confidential file names. A name like Smith-medical-records-2026.pdf reveals a lot, and some services store names unencrypted.
The wrong recipient. Autocomplete can pick the wrong address, so check it before you send the link.
Keeping files forever. The FTC advises holding sensitive information only as long as you have a legitimate business need for it.

Industry rules for sharing sensitive files

Some sectors have specific rules for protecting information you store or share. This is general information, not legal advice.

Health care: the federal health-privacy Security Rule's technical safeguards cover access control, audit controls and transmission security, including encryption, for electronic protected health information. No tool makes an organization compliant on its own.
Financial institutions: the FTC's Safeguards Rule requires covered businesses, which can include lenders and tax preparers, to encrypt customer information on their systems and in transit, or use approved alternative controls where encryption is not feasible.
Breach laws: every state has a breach notification law, according to the FTC's Data Breach Response guide, and the requirements vary by state.
Professional rules: lawyers, accountants and other licensed professionals may have confidentiality duties that vary by state or licensing body.

Where ASL Files fits

ASL Files, listed as Live, is the encrypted file store behind other ASL products, plus Secure Send for handing one file to someone outside your organization. Every stored file is encrypted with AES-256-GCM, and a download needs a valid session from the organization that owns the file, so a copied address alone opens nothing.

Secure Send returns a link and a separate password for you to send on two channels; the service sends neither. You choose a lifetime from one hour to 30 days and up to 50 opens. The recipient sees nothing about the file until the password is right, and failed attempts and opens are recorded.

Its limits are stated plainly. It is not end-to-end encryption, because the storage service holds the key. File names, types and sizes are readable in the live index, a file can be up to 15 MiB, a link cannot be cancelled early except by deleting the file, and the delivered .zip is not password-protected. See how ASL Files works.

Frequently asked questions

What is encrypted file sharing?

Sending or storing files so they are encrypted in transit, at rest or both. The important detail is who holds the keys: a provider that holds them can decrypt the files; with end-to-end encryption, only the sender and recipient can.

Is end-to-end encrypted file sharing always the better choice?

It gives the most privacy from the provider, but it usually rules out previews and server-side scanning, and a lost key can mean a lost file. Use it when only the two ends should be able to read the file.

What is the safest way to send the password for a shared file?

Use a different channel from the link, such as a phone call or a text message, and make the password long and random. Never put it in the same email or chat as the link.

How do I send large files securely?

Use a sharing service whose per-file limit fits, or encrypt the file with an archiver that supports AES-256 and send the password separately. Plain email is a poor fit; Gmail personal accounts cap attachments at 25 MB.

Is it safe to email a password-protected attachment?

It is safer than a plain attachment, but it stays in mailboxes and can be forwarded, and a password in the same thread protects little. An expiring link, with the password sent another way, leaves less behind.

Is a secure file sharing service enough for health-privacy rules?

No tool is enough on its own. A service can help with safeguards such as encryption, access control and logging, but meeting those rules depends on your own policies, agreements and practices.

Related guides

Explore the complete product

Read features, current access and limitations

Encrypted File Sharing: How to Send Files Securely and Who Holds the Keys