Secure file sharing: what each service really protects

Encryption and link life for eight services, from each one's own pages, and why email alone falls short.

What each service protects
Service	Encryption	Link life	Details
Encrypted on the service's servers
SendTheStuffLaunching soon	In transit and at rest	14 days	Links of 22 random characters. Free files deleted after 14 days, with no recovery.
WeTransfer	TLS in transit, AES-256 at rest	3 days	Password protection: Ultimate and Teams plans only. Files are deleted within 48 hours of expiry.Source: WeTransfer
Smash	TLS in transit, AES-256 at rest	7 days	Password protection: included free.Source: Smash
TransferNow	TLS in transit, AES-256 on disk	7 days	Password protection: included free, and the password encrypts the files.Source: TransferNow
SwissTransfer	TLS in transit, AES-256 at rest	30 days	Password protection: included free. SwissTransfer says this is not end-to-end encryption.Source: SwissTransfer
file.io	HTTPS/TLS in transit, encrypted at rest	Until the first download	Gone after one download.Source: file.io
End-to-end encrypted
Wormhole	End-to-end, in your browser	24 hours	The key travels in the part after the # of the link, which never reaches the server.Source: Wormhole
Encrypted only on the way
Filemail (free)	HTTPS in transit	7 days	Password protection: not on the free plan.Source: Filemail
Filebin	HTTPS in transit only	6 days	Files can be deleted by anyone who has the link.Source: Filebin

Service names link to our guide for that service. Other services' values are from their own pages, checked Oct 20, 2026.

Launching soon

Free when it launches: 5 GB per transfer, 10 transfers or 20 GB a month, and links that last 14 days.

Go to the steps

The secure way to send a file is a link that's encrypted, hard to guess, and expires on its own. Of the free services compared here, only Wormhole encrypts end to end; the others mostly encrypt in transit and at rest.

An email attachment isn't that: Gmail's standard protection is TLS in transit, and the file sits in both mailboxes until someone deletes it.

SendTheStuff, launching soon, will keep files encrypted in transit and at rest, behind a link that stops working after 14 days. Until it launches, the table above shows what each service's free version encrypts, from each service's own pages.

What SendTheStuff will do to protect a file

SendTheStuff will encrypt files in transit and at rest, with a separate key for each transfer. Destroying a transfer's key will make its files unreadable at once.

Each SendTheStuff link will be 22 random characters, so nobody can guess it, and download pages will stay out of search engines. A SendTheStuff link will work for 14 days. Free files will then be deleted, with no way to bring them back. SendTheStuff will keep no transfer past 28 days.

SendTheStuff will also help your recipient spot a fake email. SendTheStuff will put "Only download this if you expected files from" in every email transfer, followed by your address. For files that can run on a computer, SendTheStuff's download page will show "Only open this if you trust the sender."

SendTheStuff's encryption will be not end to end: it will happen on its servers, not in your browser. If you need end-to-end encryption, Wormhole is the service in the table that says it offers it.

Three levels of encryption, and who offers which

"Encrypted" can mean three different things. The table groups the services by which one they offer:

Only on the way. The file is protected while it travels, then stored as is. Filemail's free version uses HTTPS in transit. Filebin uses HTTPS in transit only, and its owner can read anything you didn't encrypt first.
On the way and on the server. The service also encrypts what it stores. WeTransfer's is TLS in transit, AES-256 at rest, and Smash's is TLS in transit, AES-256 at rest. TransferNow, SwissTransfer and file.io also encrypt stored files.
End to end. The file is encrypted in your browser, and the service never sees the key. Wormhole puts that key in the part after the # of the link, which browsers never send to its servers.

SwissTransfer is open about where it stands: its own page says its encryption is not end-to-end encryption.

Passwords, and who can open the link

A password stops a forwarded link from working on its own. Free versions split like this:

Free: Smash, TransferNow and SwissTransfer. On TransferNow, the password encrypts the files, so only the password can unlock them.
Not free: WeTransfer keeps passwords for Ultimate and Teams plans only. Filemail and Dropbox leave them off their free versions.

Send the password a different way from the link, such as a text message for an emailed link. Anyone who gets both can open the files.

Two services limit the link in other ways. A file.io file lasts one download. On Filebin, anyone who has the link can delete your files, so treat its links as public.

Is email secure enough for a document?

For everyday files, mostly. Gmail sends every message with TLS, and it stays encrypted on the way only if the recipient's service uses TLS too. Gmail flags a message that wasn't encrypted with a red open lock icon.

Gmail's stronger S/MIME encryption is for work or school accounts only. A personal Gmail address can't use it.

The bigger issue is time. An attachment stays in your sent folder and their inbox until someone deletes it. Personal Gmail also caps attachments at 25 MB, so long scans and video won't fit anyway.

How long should a file stay online?

As short as your recipient needs. Every day a link works is a day it can be forwarded or found:

Wormhole deletes files after 24 hours.
WeTransfer's free links last up to 3 days, and the files go within 48 hours after expiry.
Smash and TransferNow keep files up to 7 days.
SwissTransfer lets you choose, up to 30 days.

Pick the shortest option that still gives your recipient time to download.

Why the usual ways fall short

The common ways to send something private each leave a gap:

An email attachment. It's only as protected as the weaker of the two mail services, and it never expires.
A shared drive link. Shared with "Anyone with the link", it works for whoever it's forwarded to, for as long as the file exists.
A zipped file with a password in the same email. Anyone who reads the email has both.
SFTP. It's a protocol for IT teams and servers, not a way to hand one file to a client.
A service that encrypts only on the way. The stored copy sits unencrypted until it's deleted.

SendTheStuff will cover the common case, with files encrypted in transit and at rest, an unguessable link, and deletion on a schedule.

Until SendTheStuff launches

To send a sensitive file securely today:

Pick a service from the table that encrypts on the server, or Wormhole for end-to-end encryption.
Add a password if the free version allows it. Smash, TransferNow and SwissTransfer do.
Choose the shortest link life your recipient can work with.
Send the link and the password by different routes, such as email and a text.
Ask your recipient to confirm they have the file, then let the link expire.

Frequently asked questions

What is the most secure way to send a file?

An end-to-end encrypted link with a short life, such as Wormhole's, which encrypts in your browser and deletes files after 24 hours. Next best is a service that encrypts on its servers, with a password sent separately.

SendTheStuff, launching soon, will encrypt in transit and at rest, with links that end after 14 days.

Is email secure for sending documents?

It's encrypted on the way when both services support it, and Gmail flags an unencrypted message with a red open lock icon. But the attachment stays in both mailboxes until deleted. For a tax return or medical record, a link that expires is safer.

Can I password protect a file transfer?

Yes, for free on Smash, TransferNow and SwissTransfer. WeTransfer offers it on Ultimate and Teams plans only. Always send the password separately from the link.

How do I send a file that deletes itself?

Use a service whose links expire. Wormhole deletes files after 24 hours, and file.io after one download. SwissTransfer lets you pick a shorter life than its maximum of 30 days.

Is WeTransfer secure?

WeTransfer's encryption is TLS in transit, AES-256 at rest, and only people with the link can open the files. Its free version has no password, and links last up to 3 days.

What does end-to-end encrypted mean?

The file is locked on your device and unlocked on your recipient's, so the service in between can't read it. Of the services in the table, only Wormhole says it works that way. SwissTransfer says plainly that its own encryption isn't end-to-end.

Is secure file transfer the same as SFTP?

No. SFTP is a protocol IT teams use to move files between servers, and it needs a server set up to receive it. To send one file to one person, an encrypted link with an expiry date is simpler.

Send it when we launch