Password-protected file links

A password stops someone who only has the link from downloading the file. It does not stop anyone who has both.

How it works on multipleupload.com

When you upload, you can add a password of 6 to 100 characters. The recipient sees a password box on the link page and must enter the password before the download starts. A wrong password does not count as a download, so it cannot use up a one-download link.

We store only a salted, slow hash of the password (PBKDF2-SHA256), never the password itself. If you lose it, we cannot show it to you. Upload again with a new password.

When a password helps

The link might end up in a forwarded email or a shared chat that people other than the recipient can see.
The link is posted somewhere, such as a ticket, a shared document or a group thread.
You want a second step so that a recipient confirms they are the right person.

When it does not help

If the password travels with the link. Putting both in the same email gives the password to anyone who reads that email.
If the file is sensitive by nature. Our files are not end-to-end encrypted. We hold the file on our server while the link is active.
As protection against the recipient. Once someone has downloaded the file, they can copy or share it.

Send the password separately

Send the link in one message and the password in another, ideally through a different channel: a phone call, a text message, or a message in a different app. Tell the recipient what to expect, so they do not think the box is broken.

Protect the file yourself as well

For documents that matter, encrypt the file before uploading, for example with a password-protected archive that uses AES encryption. Then a password on the link is a second layer, not the only one.

Create a protected link