Protect Files from Hackers: Essential Security Practices

Protecting files from hackers starts with encryption — AES-256-GCM during transfer, client-side encryption before upload, and TLS 1.3 for the connection. Add expiring download links (24 hours is a sensible default), password protection with PBKDF2 at 600,000 iterations, download limits, and two-factor authentication on any account that holds sensitive data. The 2023 Verizon Data Breach Investigations Report found that 74% of breaches involve the human element — weak passwords, phishing, misconfigured shares. Technical controls fix half the problem; the rest is disciplined workflow. Here's what actually moves the needle.

The attack surface when you share a file

A file on its way from you to someone else passes through several danger zones:

• Your device — malware that reads files before encryption
• Your local network — hostile Wi-Fi, ARP spoofing, rogue DNS
• ISP and backbone links — historically targeted by nation-state SIGINT
• The transfer service's servers — breach, insider threat, legal demands
• The recipient's inbox or messaging app — where share links accumulate
• The recipient's device — same problem in reverse

Each zone needs a specific defense. Ignoring any of them leaves a reliable attack path.

Start with end-to-end encryption

The strongest single control is client-side encryption with the key never reaching the server. AES-256-GCM in the browser using the Web Crypto API produces ciphertext that's useless without the key, even if the provider is compromised. The key travels only in the URL fragment (everything after #), which browsers never send to servers.

Services that implement this correctly: Tresorit Send, Proton Drive shared links, SwissTransfer E2EE tier, Mega.nz, HexaTransfer.

Services that encrypt but aren't client-side: WeTransfer standard tier, Google Drive, Dropbox, OneDrive share links, Box standard sharing. These rely on the provider's honesty and competence — fine for low-sensitivity content, insufficient for anything you'd be uncomfortable seeing in a breach headline.

Use expiring links, always

A share link that lasts forever is a breach waiting to happen. Email archives get leaked, Slack exports get stolen, laptops get sold on eBay with browser history intact. Time-bound links limit the damage.

Sensible defaults:

• Personal files: 24–72 hours
• Business documents: 7 days max
• One-time secrets: 1 hour or one-download

Configure burn-after-reading where available. Password resets, credentials, and one-time codes should self-destruct the moment they're read. Single-download links make the second access attempt fail loudly, which is good — you want to know if your link was intercepted.

Passwords on top of links

The URL fragment alone means anyone with the link can download. Adding a password turns a single-channel share into two-factor: attacker needs both the link and the password, ideally sent through different channels.

Implementation that actually works:

• PBKDF2-HMAC-SHA-256 with at least 600,000 iterations (OWASP 2023), or Argon2id with 64 MB memory.
• 12+ character passwords drawn from a password manager, not "Spring2025".
• Password delivered through a different channel than the link — Signal if the link was emailed, SMS if the link was in Slack.

A determined attacker can still brute-force weak passwords offline if they intercept both the ciphertext and the salt. The KDF slows them; strong passwords stop them.

Lock down your accounts

If you use an account-based service, the account itself becomes an attack target. The 2022 Uber breach started with credential-stuffing against a contractor's login.

Minimum hygiene:

• Unique password per service from a password manager (1Password, Bitwarden, Proton Pass).
• Two-factor authentication — prefer TOTP (Google Authenticator, Authy) or hardware keys (YubiKey, Titan) over SMS, which is vulnerable to SIM swap attacks.
• Passkeys where available — WebAuthn-backed, phishing-resistant, increasingly supported.
• Session timeouts of 30 days or less.
• Device management — review active sessions, revoke anything you don't recognize.

Google, Microsoft, and Apple now default to 2FA for new accounts. Self-hosted and smaller services often don't.

Audit your device

Endpoint security is the weakest link because attackers know it. If your laptop is compromised, every file you encrypt was readable before encryption. Baseline:

• Full-disk encryption — FileVault on macOS, BitLocker on Windows Pro, LUKS on Linux.
• OS and browser updates within 7 days of release. The 2021 Pegasus iMessage zero-click exploit hit devices missing patches.
• Reputable antivirus / EDR on Windows — Microsoft Defender is acceptable for most users.
• No pirated software. Cracks and keygens are the most common malware vector for non-targeted home users.
• Lock screen password with a 10+ character passphrase.
• Remote wipe enabled (Find My Mac, Microsoft Find My Device, Apple Find My).

For high-risk work (journalism, legal, research with adversarial nation-states), consider a dedicated laptop with tight software hygiene, or Qubes OS for compartmentalization.

Verify the recipient

Sending a sensitive file to the wrong address is its own breach category. The 2017 Equifax notification emails accidentally pointed users to a phishing domain. Prevention:

• Confirm the email address through a second channel before sending. Call the recipient, check an encrypted messenger, re-read the address letter by letter.
• Use unambiguous identifiers in filenames so the recipient knows immediately if they received the wrong file.
• Start with a test file — a 1 KB text file confirms the address and the process before you send the actual sensitive content.
• Watch for homograph attacks — rn looks like m, Cyrillic а looks like Latin a in domain names.

Watch your metadata

Encryption hides contents, not filenames, sizes, or timestamps. Metadata leaks can be as damaging as content leaks. Two examples:

• A file called Q4-2025-layoffs-final.xlsx tells a story before anyone decrypts it.
• Photos embedded with EXIF GPS coordinates can reveal your home address to anyone who receives them.

Mitigations:

• Rename files to neutral names before sharing (attachment.xlsx instead of the telling name).
• Strip EXIF data with exiftool -all= photo.jpg before sending.
• Use services that encrypt filenames alongside contents (Tresorit, Proton Drive, HexaTransfer do this).
• Round file sizes by padding when possible.

Monitor access when you can

After sending, visibility matters. Services that show download events let you detect problems early:

• Did the recipient download? (Expected.)
• Was there a second download from a different IP? (Intercepted?)
• Did the link get accessed in a country you weren't expecting? (VPN or leak.)
• Are there failed password attempts? (Brute force in progress.)

Tresorit and Proton Drive log access; SwissTransfer shows download counts; most consumer services don't. Even counting downloads is useful — a one-download link that's been downloaded twice is a loud alarm.

Backup before you delete

A file deleted after a 24-hour transfer is gone from the service. Make sure you have a local copy if you'll need the file later. A dedicated archive disk with AES-256-XTS full-disk encryption (LUKS, VeraCrypt) plus offsite backup to Backblaze B2 or AWS S3 with server-side encryption is a standard personal setup.

Three copies of important data in at least two locations, with at least one offline — the 3-2-1 rule — survives ransomware better than cloud-only storage.

A practical daily routine

For anyone sharing sensitive files regularly:

1. Encrypt at rest locally with VeraCrypt containers or FileVault.
2. Use a client-side encrypted transfer service by default.
3. Set 24-hour expiration and single-download limit.
4. Add a strong password from a password manager, sent through a second channel.
5. Verify the recipient before hitting send.
6. Confirm download, then delete the local copy of the share link.

Total overhead: about 30 seconds per transfer. Breach risk reduction: substantial.

Try it at hexatransfer.com — free, no account, 10 GB max.