Encrypted file sharing: three things 'encrypted' can mean, and which one you need

A client asks whether your file sharing is encrypted. You check the vendor's website, and it says yes, with a padlock icon and "bank-grade AES-256". So you tell the client yes.

The trouble is that every vendor says yes. The word covers three quite different protections, and only one of them stops the provider from reading your file. Before you send a threat assessment, a contract or a patient letter, it is worth knowing which one you are getting.

Encrypted file sharing: the three things it can mean

When a file sharing service says your files are encrypted, it usually means one or more of these.

Encryption in transit protects the file while it travels between your device and the provider's servers, normally with TLS, the same thing that puts the padlock in your browser. Almost every service does this.

Encryption at rest means the file is encrypted on the provider's disks. If someone steals a drive, they get scrambled data. But the provider holds the key, so it can still decrypt the file whenever it needs to.

End-to-end encryption, sometimes called client-side or zero-knowledge, means the file is encrypted on your device before upload, and the provider never receives the key. Only this one stops the provider, or anyone who can compel it, from reading the file.

Where the key lives is the whole question

You don't need to understand the maths to judge a vendor's claim. You only need one answer: who holds the key?

If the provider holds it, your file is protected from outsiders but not from the provider, its staff with access, or a legal demand made to it. That may be fine for a menu or a brochure. It is a weaker promise for an ID scan or a site survey.

If only you and your recipient hold it, the provider stores data it can't read. The cost is convenience. Features that need to see the file, like previews generated on the server or bundling files into a zip, often don't work on encrypted files.

How to check any vendor's encryption claim

Ask four questions, and look for the answers in the vendor's own documentation rather than on its homepage.

1. Is the file encrypted before it leaves my device?
2. Does the provider ever receive the key, or a way to rebuild it?
3. Which plans include that, and is it on by default?
4. What isn't covered, such as file names, form answers or access logs?

If the answer to the first question is "encrypted with AES-256 on our servers", that is encryption at rest. It is worth having, but it is not end-to-end. Dropbox is a good example, and we went through it in Dropbox is encrypted. That is not zero-knowledge.

Is there a free way to share encrypted files?

Yes, and TinyX isn't it. Tresorit Send is free and encrypts files on your device before upload, with up to 5 GB per link, 10 downloads and a seven-day life. Proton Drive's free plan gives you 5 GB of storage with end-to-end encryption on every plan.

Some popular free tools encrypt in transit and at rest but not end to end. SwissTransfer, for example, describes its files as encrypted in transit and at rest, and WeTransfer doesn't describe its free plan as end-to-end encrypted. Both are fine for large, non-sensitive files. We covered the free limits in WeTransfer's free limit in 2026.

What TinyX encrypts, and on which plan

On Pro and Max, TinyX encrypts files in your browser with AES-256-GCM before upload. The key is carried in the part of the link after the "#", which browsers don't send to our servers. So we store files we can't read. How TinyX encrypts your files goes through it step by step.

On Free, you get password protection and expiry, and your files sit in the middle layer described above: encrypted on the way and on our storage provider's disks, but not end to end. For files only you and your recipient can read, use end-to-end encryption on Pro and Max. Upload links come with Pro and Max, and end-to-end encryption on an upload link is optional: you turn on "require encryption", which also needs a password.

There are limits we would rather state than have you find. Questionnaire answers aren't end-to-end encrypted. Folder links can download as one zip only for unencrypted files. We keep access logs for 7, 90 or 365 days depending on plan, so we log the minimum we need, not nothing. And TinyX runs on Cloudflare, a US company, with no region pinned, so we don't claim EU hosting.

Encryption is one control, not the whole job

Even end-to-end encryption doesn't help if the link and its key end up in the wrong inbox. That is why the habits around the link matter as much as the maths.

Send the password by a different channel from the link. Set an expiry date before you send, so the link doesn't outlive the job. And give each recipient their own link, so you can see who opened what. How to password-protect a link or file covers the practical side, and our guide to secure file sharing for security companies shows it in a real workflow.

Where to start

If what you share needs end-to-end encryption, compare Pro and Max on the pricing page. If a password and an expiry date are enough for now, the Free plan covers both.