Share sensitive files with a client safely using encryption and expiring links

TL;DR — The safest simple workflow is: put the file in a password-protected ZIP (an encrypted archive), upload it to a reputable file-sharing service using a private link with an expiry date, and send the password in a different channel than the link. The most common mistake is sending both the file link and the password in the same email or chat thread. Reading time: ~5 min

Goal

When you are done, your client will have a private download link to the file, the file itself will be encrypted before upload, the link will expire after a set date, and the password needed to open the file will have been sent separately.

Prerequisites

• The file you need to send, saved on your computer
• Your client’s email address and a second contact method for them, such as SMS or a phone number
• Access to a file-sharing service account that supports private sharing and link expiry in your provider’s dashboard (for example: OneDrive, Google Drive, Dropbox, Box, or your company’s approved portal)
• A ZIP tool that supports password protection:
  • Windows 11: 7-Zip 24.x or newer recommended
  • macOS 14+ or 15+: built-in Terminal available, or Keka if you prefer a desktop app
• Enough free space to create a second copy of the file as an encrypted archive
• The agreed retention date for the file, such as “delete after 14 days”

Steps

Step 1: Put the file in its own folder

Create a new folder on your computer and move only the files you intend to share into it.

Windows: File Explorer → right-click in a blank area → New → Folder → name it exactly:

Client-Share-2026-10

macOS: Finder → File → New Folder → name it exactly:

Client-Share-2026-10

What you should see when this succeeds: one folder named Client-Share-2026-10 containing only the files the client should receive.

Step 2: Create an encrypted ZIP file

Use a password-protected ZIP so the file is encrypted before it leaves your computer.

Windows with 7-Zip: File Explorer → right-click the Client-Share-2026-10 folder → 7-Zip → Add to archive

Use these exact values in the window:

Archive format: zip
Encryption method: AES-256
Enter password: [create a unique password]
Reenter password: [same password]

Then click:

OK

macOS with Terminal: Open Terminal, then run:

cd ~/Desktop
zip -er Client-Share-2026-10.zip Client-Share-2026-10

When prompted, type a password and press Enter twice.

What you should see when this succeeds: a new file named Client-Share-2026-10.zip in the same location.

Step 3: Generate a strong password and save it temporarily

Create a unique password for this one transfer. Do not reuse an old password.

If you use a password manager, create a new secure note named:

Client-Share-2026-10 password

If you do not use a password manager, generate a password in your browser:

• Open your browser’s password generator or use your company-approved password tool
• Create a password with these exact minimum values:

Length: 16 characters
Uppercase: on
Lowercase: on
Numbers: on
Symbols: on

What you should see when this succeeds: you have the password stored somewhere private, ready to send separately.

⚠️ Do not upload the unencrypted original file if it contains personal data, financial records, credentials, or database exports. Upload only the .zip file you created in Step 2.

Step 4: Upload the encrypted ZIP and create a private link

In your file-sharing provider’s dashboard, upload the ZIP file and create a link with restricted access.

Use your provider’s dashboard path. Common examples are:

Google Drive: New → File upload → select Client-Share-2026-10.zip
OneDrive: Upload → Files → select Client-Share-2026-10.zip
Dropbox: Upload or drop → Files → select Client-Share-2026-10.zip
Box: New → File Upload → select Client-Share-2026-10.zip

After upload, open the share settings for that file and set these exact values where your provider offers them:

Access: Only people with the link OR Specific people
Allow editing: Off
Download: On
Expiry date: 14 days from today
Password on link: On, if your provider supports it

If your provider offers both “Anyone with the link” and “Specific people,” choose:

Specific people

when possible.

What you should see when this succeeds: a share link is created, and the file is marked view/download only, not editable.

Step 5: Send the link and password in separate channels

Send the download link by email, then send the ZIP password by SMS or phone call.

Email template:

Subject: Secure file for you

Hello,

Here is your secure download link:
[PASTE LINK HERE]

The file link expires on [DATE]. I will send the password in a separate message.

Please confirm once you have downloaded and opened the file.

SMS template:

Password for the secure ZIP: [PASTE PASSWORD HERE]

If you must use email only, send the password in a separate email thread after the client confirms they received the link email.

What you should see when this succeeds: the client has the link in one channel and the password in another.

Step 6: Remove the original from the shared area after confirmation

After the client confirms successful download, delete the shared file from the file-sharing service, then empty the trash if your provider keeps deleted files in a recoverable state.

Typical dashboard paths are:

File → Delete
Trash/Deleted files → Empty trash / Permanently delete

If your company requires retention, keep the encrypted ZIP in your approved storage location instead of your desktop.

What you should see when this succeeds: the link no longer works, or the file is no longer present in the shared folder.

Verify it works

Do these checks before you consider the task finished:

1. Open the share link in a private/incognito browser window.
2. Confirm you can reach the download page without seeing unrelated files.
3. Download the ZIP file.
4. Open it and verify it asks for a password.
5. Enter the password from Step 3.
6. Confirm the expected file opens correctly.
7. Check the expiry date in the share settings matches your intended date.

Expected result:

- The link opens only the intended file
- The ZIP cannot be opened without the password
- The password works
- The link shows the correct expiry date

Common pitfalls

Sending the link and password in the same message

Mistake: You email the download link and the ZIP password together.

Symptom: Anyone who gains access to that one email can open the file immediately.

Fix: Send the link by email and the password by SMS or phone call.

Uploading the original file instead of the encrypted ZIP

Mistake: You drag the PDF, spreadsheet, or database export into the sharing service, not the .zip file.

Symptom: The client can open the file without a password, and anyone with access to the link can too.

Fix: Delete the uploaded original, upload Client-Share-2026-10.zip, and send a new link.

Choosing edit access instead of view/download access

Mistake: The share setting is “Can edit” or “Editor.”

Symptom: The client can change or replace the file, or the service shows collaboration tools you did not intend to enable.

Fix: Change the share permission to View or Download only and regenerate the link if needed.

Forgetting to set an expiry date

Mistake: The link stays active indefinitely.

Symptom: Weeks or months later, the old link still works.

Fix: Open the file’s share settings and set Expiry date: 14 days from today, or your company’s required retention period.

Reusing an old password

Mistake: You use the same ZIP password you used for a previous client or project.

Symptom: A password exposed in one place can unlock other files.

Fix: Create a new 16+ character password for every transfer.

Leaving the file in trash after deletion

Mistake: You delete the shared file but do not empty the provider’s trash.

Symptom: The file may still be recoverable by account users or admins during the retention window.

Fix: Open Trash or Deleted files in your provider and permanently delete the file if your policy allows it.

This article was written by an AI system and published pending human review. Verify anything you intend to act on.