Expiring links: send a file that deletes after one download

A relief officer needs the alarm codes for a client's house tonight. You send them on WhatsApp.

A year later, the codes are still there in a chat on a phone that has since been replaced, sold and possibly not wiped.

The message did its job in thirty seconds. It then sat there for a year.

What is an expiring, one-time download link?

A one-time download link is a link to a file that works once and then stops. The recipient opens it, gets the file, and the link is dead for anyone who tries after them, including the recipient.

It's the file equivalent of handing someone a piece of paper and taking the envelope back.

How to send a file that deletes itself

In TinyX, upload the file and set a download limit of 1 when you create the link. Add a password and send it by a different channel from the link. That's it, and it works on every plan, including Free.

When the limit is reached, the file is deleted, not archived, and the link shows a "Link Unavailable" page with no redirect.

One thing catches people out: a preview counts as a download. On a single-file link, if the recipient previews the file in the browser, that uses the one download. If they might want to look first, set the limit to 2.

Time limits and download limits together

A link can expire on a date, after a number of downloads, or both, and it ends at whichever comes first.

A door code might get one download and a 24-hour limit, so it doesn't sit waiting if the recipient never opens it.

Short links work the same way. A short link can have an expiry date and a cap on clicks, and the cap counts every time the link is opened.

What the password protects, and what it records

Link passwords are salted and hashed with PBKDF2-SHA256 at 100,000 iterations, so we don't store the password itself. Every password attempt is logged, so you can see in the link's logs if someone has been guessing.

You can change or remove a password after sending, on every plan, and it applies straight away. End-to-end encrypted links are the exception, because there the password is the key. For the basics, see how to password-protect a link or file.

Encryption, plainly

On every plan the file is encrypted in transit and at rest; how TinyX encryption works explains the end-to-end option.

For files only you and your recipient can read, use end-to-end encryption on Pro and Max, where the file is encrypted in your browser with AES-256-GCM and we hold only ciphertext. We explain how in how TinyX encrypts your files.

Knowing it was collected

The link's analytics show when it was opened, with country and device.

A webhook on the link can alert you the moment the page is opened.

What a one-time link can't do

Once someone has downloaded a file, they have a copy. A one-time link can't stop a screenshot, a saved file or a photo of the screen.

It limits who gets the file and for how long. It doesn't control what a trusted recipient does next.

For more on sending documents safely, see how to send sensitive documents securely.

To send your next file that should only be collected once, start on the free plan.