How long should a shared file stay downloadable?

The instinct is that a longer expiry is a better product. It is not — it is a longer window in which a link you have forgotten about is still a working key to your file.

Why permanent links leak

A share link is a bearer credential: whoever holds it gets in, with no further check. That is exactly what makes it convenient, and it is why the link's lifetime is the thing that matters. Consider where the link ends up in an ordinary week.

• Pasted into a group chat, where anyone who scrolls back finds it — including people who joined afterwards.
• Forwarded, because forwarding a link is easier than explaining what is in it.
• Sitting in an email thread that gets synced to three devices and backed up indefinitely.
• Cached in a chat backup or a screenshot on someone's camera roll.
• Crawled and indexed, if the link was ever posted anywhere public. Search engines find share links routinely; this is a well-documented way private documents become public.

None of these require an attacker. They are ordinary things people do with links. The file does not become sensitive later — it was always sensitive, and it stayed reachable long enough for one of these to happen.

Expiry is the control, not the inconvenience

Once you see a share link as a credential, the case for expiry is the same as the case for rotating any credential: it limits the blast radius of a leak you do not know about. If the link stopped working after three days, the copy sitting in a group chat from last March is inert. The exposure window is the security property; everything else is detail.

Automatic expiry also solves the part humans reliably fail at. "Delete it when you are done" is advice nobody follows, because the moment you are done is the moment you stop thinking about the file. A deletion that happens whether or not anyone remembers is the only kind that actually happens.

How long is enough

The useful question is how long the recipient realistically needs, not how long feels generous.

Roughly three days covers the overwhelming majority of real transfers, which is why so many services land near that number. A week covers the long tail — a recipient travelling, a weekend in the way, an assistant forwarding to someone else.

When the file has to outlive the link

If the recipient needs the file for months, a transfer service is the wrong shape entirely, no matter how long you can stretch the expiry. Transfer services are a delivery mechanism; they are not storage, they usually have no versioning, no access log worth the name, and no way to revoke access from one person out of the ten you sent the link to.

The right move is to use the transfer for delivery and let the recipient put the file where it belongs — their own drive, their own repository, their own backups. Then expiry costs you nothing: by the time the link dies, the file has already arrived somewhere it is meant to live.

More guides