How to send documents securely (without trusting the inbox)

A hotel security manager needs your principal's passport scan and the arrival itinerary by tonight. The easy option is an email with two attachments. It will arrive in seconds, and it will still be sitting in three inboxes next year.

Sending sensitive documents securely isn't about one clever tool. It's a few habits that make the document useless to anyone who isn't meant to have it.

How to send documents securely

Four habits do most of the work. Use a link instead of an attachment, protect it with a password sent another way, set it to expire before you send it, and confirm it arrived.

Each one closes a different gap. Together they mean a forwarded email, a misaddressed message or an old inbox is no longer a leak.

Why email attachments are the weak point

An attachment is a copy. Once it's sent, it lives in your sent folder, the recipient's inbox, their phone and any backups, and you can't take it back.

Email also gets misaddressed and forwarded. You can control what you send. You can't control what happens to a copy after that.

Option one: encrypted email

Some email services offer end-to-end encryption between their own users, and Gmail has a confidential mode that adds an expiry and a passcode to a message.

These help, but both depend on what the recipient uses, and a determined recipient can still save or screenshot.

If both sides already use the same encrypted email service, it's a reasonable choice.

Option two: a password-protected zip

Zipping a file with a password is better than nothing. The weakness is that the file is still an attachment, so it still lives forever in inboxes, and the password often travels in the same email.

If you use this, send the password by phone or a messaging app, never in the email.

Option three: a cloud drive share

Google Drive and Dropbox can share a file with named people.

The trap is "anyone with the link", which has no expiry of its own, as we covered in Google Drive will expire a named share. "Anyone with the link" will not.

Option four: an expiring, password-protected link

This is what TinyX does. You upload the file and get a link with a password and an expiry, which can be a date, a download limit or both.

On every plan, including Free, the file is purged when the link expires and the link shows a dead page with no redirect.

Set the expiry before you send, not after the job. A passport scan for a hotel check-in might get two days and two downloads.

On Free, a file is encrypted on its way to us and on disk, but not end to end. For files only you and your recipient can read, use end-to-end encryption on Pro and Max. There, files are encrypted in your browser with AES-256-GCM, so we hold only ciphertext we can't read. The different meanings of "encrypted" are in encrypted file sharing: three things it can mean.

Send the password another way

Whatever method you use, the password should never travel with the file. Email the link and text the password, or read it out on a call. Then a single intercepted or forwarded message opens nothing. There's a step-by-step in how to password-protect a link or file.

If you think a password has leaked, you can change or remove it on the link after sending, on every plan, and it takes effect straight away. End-to-end encrypted links are the exception, because there the password is the key.

Confirm it arrived

Check the link's analytics to see whether it's been opened, with country and device. If you want to know the moment it happens, a webhook can notify your team's chat. The Free plan includes 1 webhook.

If a link is opened from somewhere you didn't expect, that's a reason to ask questions. Analytics tell you what happened. They don't stop anything on their own.

What no method can do

Once someone has opened a file, they can save it, print it or photograph the screen. Expiry and passwords limit who gets in and for how long. They don't control what a trusted recipient does next.

If you handle government information, follow your organisation's rules and the Government Security Classifications rather than any general guide. Security teams can find more on our secure file sharing for security companies page.

To send your next sensitive document on a link that expires, start on the free plan.