Secure File Sharing: Send Documents Without Leaking Them

The documents you share are usually the ones you least want leaked: tax returns, signed contracts, scans of your ID, medical records. The way you send them matters more than most people realize. This guide covers what is at risk, where the common mistakes happen, and how to share files so only the right person gets them.

What is actually at risk

A single shared document can expose enough information to let someone open credit in your name or access medical care under your identity. The files that carry the highest stakes are:

• Tax documents, which include your Social Security or national insurance number, income, and address.
• Contracts, which often contain bank details, signatures, and business terms you would not want public.
• ID scans, which give someone a near-complete identity kit in one image.
• Medical records, which are sensitive both legally and personally.

Once any of these leaves your control, you cannot reliably take it back.

How people share files dangerously

Two habits cause most exposure. The first is attaching files to unencrypted email. Email travels in a way that service providers can read, and an attachment can live in your sent folder and the recipient's inbox indefinitely. For a deep look at how your messages travel and who can read them, see our email privacy guide.

The second habit is sending public links that never expire. Cloud storage services default to links that anyone with the address can open, forever. If that link leaks into a search engine or an old message thread, your document becomes public. Many cloud account breaches start with a forgotten public link, not a hacked password.

The better options: encryption, expiring links, and passwords

Safer sharing usually combines three ideas:

1. End-to-end encrypted services scramble the file so that only you and the recipient can read it. The service provider cannot open it, even if it is asked to.
2. Expiring links stop working after a set time, so a link that sits in an inbox for a year no longer opens anything.
3. Password-protected shares add a second barrier. Share the password through a different channel than the link, such as a phone call or a separate message.

For documents that are already sitting in cloud storage, our cloud storage privacy guide explains how to audit who has access before you share anything new.

How to check what a service actually protects

Marketing language like "secure" and "protected" does not tell you much. Instead, check a few specific facts before you trust a service with a sensitive file:

• Does it advertise end-to-end encryption, or only encryption in transit and at rest? The latter means the provider's own staff can technically read your files.
• Can you set link expiry dates and revoke access after sharing?
• Does the provider store keys on its servers, or only on your devices?
• What happens to the file if you delete it? On some services, deleted files stay recoverable for weeks.

The download side: files you receive can carry malware

Receiving a file is not risk-free. Documents sent to you can carry malware, and a message from a familiar name does not guarantee safety. Accounts get compromised, and attackers use stolen accounts to send poisoned files to everyone in the address book. Before you open anything:

• Confirm with the sender through a separate channel that they really sent the file.
• Be suspicious of unexpected attachments with generic names like "invoice" or "report".
• Keep your operating system and software updated so known exploits are patched.

What to do with files after sharing

Sharing is not the end of the process. After the recipient has the file:

• Revoke or expire the link as soon as it is no longer needed.
• Delete local copies you no longer need, and empty the recycle bin or trash where those copies may linger.
• Store anything you must keep in an encrypted location rather than in plain sight on a shared drive.

Cleaning up old files is a small habit that removes a large part of the risk. If you want to hold on to documents safely over the long term, our backup strategy guide covers keeping copies encrypted and organized.

The honest note: encryption is not automatic

No service encrypts your files just because you signed up. End-to-end encryption usually has to be turned on, and some providers only encrypt messages by default while leaving file shares in a weaker mode. Read the settings and the security documentation before you trust a service with anything sensitive. Government security agencies such as the FTC, EFF, and CISA publish plain-language guidance on these exact topics, and their material is a better reference than any single product review.

FAQ

Is emailing a PDF attachment safe enough? No. Standard email is not end-to-end encrypted, and the attachment can stay readable in inboxes and on servers for years. Use an encrypted sharing service for anything sensitive.

Are public cloud links safe if no one knows the address? Not really. "Security through obscurity" fails when links leak, which happens all the time. Set an expiry date and a password, and revoke access when you are done.

What does end-to-end encryption actually mean? It means only you and the intended recipient can decrypt the file. The provider cannot read it, which protects you even if the provider's servers are compromised.

Can a received file harm my computer? Yes. Documents can contain malware, especially when a sender's account is compromised. Verify unexpected files through a separate channel first.

Sources and further reading

• FTC Consumer Advice
• EFF: Surveillance Self-Defense
• CISA

---

Written by Hassan Arshad, founder of UsefulOrbit. Last updated August 31, 2026.