When you share files online, you’re trusting someone else’s servers with your data. That trust should be earned. Here’s what actually keeps your files secure, and what’s just marketing.
Encryption: What It Really Means
Not all encryption is created equal. The term gets thrown around loosely, so let’s clarify what matters.
At-Rest Encryption
Most file sharing services encrypt files “at rest” on their servers. This protects against someone physically stealing their hard drives. It doesn’t protect against:
- The company itself viewing your files
- Government subpoenas
- Employee access
- Hackers who compromise the service
At-rest encryption is table stakes. Every serious service has it. But it’s not enough by itself.
End-to-End Encryption (E2E)
With E2E encryption, files are encrypted on your device before they leave. The service never sees the unencrypted content. Only someone with the decryption key (usually in the URL) can read the files.
This protects against everything at-rest encryption misses. Even if the company is hacked, or forced to hand over data, they physically can’t decrypt your files.
Services with real E2E:
- FileGrab Pro
- Wormhole
- MEGA
- Tresorit
- Sync.com
Services with only at-rest:
- WeTransfer
- Dropbox
- Google Drive
- OneDrive
Zero-Knowledge
Zero-knowledge is E2E encryption plus a promise: the service is designed so they can’t access your data even if they wanted to. The encryption key never touches their servers.
FileGrab implements this by putting the decryption key in the URL fragment (the part after #). Browsers don’t send URL fragments to servers, so FileGrab literally never receives the key.
Password Protection vs. Encryption
These are different things, and mixing them up leads to false security.
Password protection controls who can download files. Without the password, you can’t access the link. But the service can still see the files.
Encryption scrambles the file contents. Even with access to the raw data, you can’t read it without the key.
The strongest setup uses both: encrypted files behind a password-protected link. That way, even if someone guesses or intercepts the password, they still can’t decrypt the content.
How to Share Files Securely
1. Use E2E Encryption for Sensitive Files
Tax documents, contracts, medical records, client work - anything you wouldn’t want posted publicly. E2E encryption means only you and the recipient can read it.
2. Keep Links Private
Shareable links are powerful, but treat them like passwords. Don’t post them publicly. Send them directly to intended recipients.
3. Set Appropriate Expiration
Forever links are convenient, but they’re also forever risks. For sensitive files, shorter expiration reduces the window where something can go wrong.
4. Use Unique Links
Don’t reuse the same link for different purposes. Create new links for each sharing context. This limits exposure if one link is compromised.
5. Verify Recipients
Before sending sensitive files, confirm you’re sending to the right person. Phishing attacks impersonate legitimate requests. A quick verification call can prevent major problems.
6. Check Service Security Practices
Before trusting a service with your files, check:
- Do they have E2E encryption?
- Where are servers located? (Privacy laws vary)
- What’s their track record? (Have they been breached?)
- Who owns them? (Acquisitions can change privacy policies)
What FileGrab Does
FileGrab offers layered security that scales with your needs:
Free tier:
- TLS encryption in transit
- At-rest encryption on servers
- No ads (ads can be vectors for malware)
- Automatic expiration (7 days)
Pro tier adds:
- End-to-end encryption (AES-256-GCM)
- Zero-knowledge architecture
- Password protection
- Custom expiration
- Private link visibility
The E2E encryption in FileGrab works like this: when you create an encrypted link, your browser generates a random key. Files are encrypted with that key before upload. The key goes in the URL fragment, which your browser never sends to our servers. Only someone with the complete URL can decrypt the files.
Common Mistakes
Trusting “Secure” Marketing
Every service claims to be secure. Look for specifics: what type of encryption, who holds the keys, what their privacy policy actually says.
Sending Passwords in the Same Channel
If you email someone a link and then email them the password, anyone who compromises their email has both. Send the password through a different channel (text, call, etc.).
Forgetting About Metadata
Even encrypted files have metadata: filenames, sizes, upload times. This information isn’t always encrypted. For maximum privacy, consider neutral filenames.
Assuming Deletion is Instant
When you delete files from a service, they might persist in backups for a while. For truly sensitive content, encryption is more reliable than deletion.
Deep Dives
Want to learn more about specific security topics? Check out these detailed guides:
-
Zero-Knowledge File Sharing: What It Means - Understand the mathematics behind true privacy and how to verify if a service offers real zero-knowledge protection.
-
How to Share Encrypted Links Safely - Practical guide to sharing encrypted FileGrab links securely, including which channels to use and which to avoid.
-
HIPAA-Compliant File Sharing - Security requirements for healthcare organizations sharing patient data.
The Bottom Line
Security isn’t binary. It’s layers of protection that compound. E2E encryption is the foundation for sensitive files. Add password protection, short expiration, and good practices on top.
For most file sharing, at-rest encryption and TLS are enough. For anything sensitive - financial documents, personal information, client work - E2E encryption should be non-negotiable.
Try FileGrab - End-to-end encryption available on Pro plans.