Passport scans, contracts, medical letters, payroll exports: some files shouldn't sit readable in someone's inbox or cloud drive for years. The simplest fix works with whatever service you already use: encrypt the file first, then send it any way you like.
The three-step method
- Encrypt the file on your device. Use the free Encrypt tool: drop the file, choose a long passphrase, and download the .pcipher copy. Nothing is uploaded.
- Send the encrypted copy by email, chat, Drive, Dropbox, WeTransfer or a USB stick. Anyone who intercepts it sees random bytes.
- Send the passphrase separately, ideally as a one-time secret link or by phone. Never in the same email as the file.
The recipient opens the same page, drops the file in, types the passphrase and gets the original back. They don't need an account.
Why not rely on the service's own security?
Most file-sharing services encrypt files "at rest", but they hold the keys. That protects against a stolen hard drive, not against a compromised account, a mistaken share setting, a subpoena or an employee with access. Encrypting yourself first means the protection doesn't depend on any of those going right. (The difference, explained.)
Pick a passphrase that survives
The file is only as safe as its passphrase, because someone who has the file can try guesses offline for as long as they like. Use four or five random words, or let a generator make one. See how to make a strong password you can remember.
Large files
Encryption happens in chunks, so big files don't need to fit in memory all at once. The browser tool handles files up to about 2 GB. Very large files are better encrypted with the Potent Cipher desktop app.
Checklist
- Encrypted on your device before it left
- Passphrase sent by a different route
- The readable original deleted from places it doesn't need to be (Downloads, Desktop, old email drafts)