Password Protection
Sometimes you want a transfer locked. A client deliverable that shouldn't end up forwarded around an inbox. Pre-release work that needs to stay quiet. Files where the link could leak. Adding a password is a one-click thing.
How it actually works
When someone opens a protected link, they hit a lock screen first. File names, previews, sizes. All hidden until the password is entered. Once they unlock, the page works exactly like any other ZappFiles download page. Pick the files they want, hit download, done.
The password itself is one-way hashed before it's saved. That's the same approach login systems use, which means if our database ever leaked, nobody could read it. The flip side: if you forget what you set, we can't recover it. You'd set a new one.
Setting one up
In the upload settings panel next to your file list, hit the lock button, type in the password, save. The icon turns blue when there's a password set. You can change or remove it any time before the transfer goes out, or later from your upload history if you want to update an active link.
Then share the link and the password with your recipient. We recommend sending them through different channels. Link by email, password by message. That way one leak doesn't expose both.
A few things worth knowing
- Available on Pro and Max plans.
- Pick something your recipient can actually type. Long random strings are great in theory, painful in practice.
- Skip the obvious ones. Project name, client name, your company. Anyone with the link can guess those.
- For really sensitive deliveries, pair the password with delete after download so the files disappear after the first successful pull.
Once they're in
Refreshing the same browser tab keeps your recipient unlocked for a short window so they don't have to type the password again every time. Close the tab or wait it out and they'll need to enter it again. Closing the loop on accidentally-still-open browser sessions.
The bigger picture
Password protection sits on top of everything else ZappFiles already does. TLS in transit, AES-256 at rest, signed download URLs, expiry, delete after download. The full picture is on the Encryption and Privacy page.