Send Files to Clients: Professional File Delivery Guide

A professional file delivery to a client has four traits: it's fast for the client to access, it doesn't need them to create an account, the link expires on a known date, and it doesn't leak confidentiality. Email attachments fail three of the four (25 MB Gmail cap, no expiry, often scanned and cached by mail gateways). A purpose-built transfer link with an expiry date and a password is the minimum viable professional standard in 2026. Clients notice — and remember — who sends deliverables cleanly.

What "professional" actually means at the file level

Clients judge your delivery process before they judge the deliverable. Concretely:

• The download takes one click. No signup, no invite email, no "request access" workflow.
• The filename is self-describing. Final_Brand_Guide_v3_Acme_2026-04-10.pdf, not FINAL_final_v2.pdf.
• The archive is clean. No __MACOSX, no .DS_Store, no Windows Thumbs.db.
• The link has an expiry. 7 or 14 days is the norm for project delivery. It signals "this isn't indexed on Google forever."
• There's a password. Shared separately (Signal, phone call) — never in the same email as the link.
• You get a read receipt. Knowing the client downloaded the file saves three follow-up messages.

The 25 MB attachment trap

Gmail, Outlook.com, iCloud Mail, and most corporate MX gateways cap attachments at 20–25 MB. Over that, the message bounces with a cryptic SMTP error. Workarounds clients hate:

• Splitting a PDF into four parts with 7-Zip
• Sending "please request access" Google Drive links that trigger IT approval queues
• Asking the client to join Dropbox, "just this once"

A transfer link cuts the problem. One URL. Any size up to the service's cap (10 GB on many free services, 50 GB on SwissTransfer, 100 GB on Dropbox Transfer paid, 250 GB on Smash Pro).

Naming and organising the deliverable

Before uploading, zip the deliverables into one archive with a clear internal structure:

Acme_Website_Launch_2026-04-10.zip
├── 01_Source/
│   ├── figma-export.zip
│   └── photoshop-masters.zip
├── 02_Exports/
│   ├── logo-primary.svg
│   ├── logo-primary.png (1200×400)
│   └── favicon-32x32.png
├── 03_Deliverable_PDFs/
│   └── Brand_Guide_v3.pdf
└── README.txt

The README.txt lists what's inside and where it's licensed. It takes three minutes to write and eliminates 80% of follow-up questions.

Expiry dates as a professional signal

Setting a 14-day expiry does two things: it forces you to follow up with the client if they haven't downloaded, and it reassures privacy-minded clients (law firms, health systems, anyone subject to GDPR, HIPAA, or CCPA) that the file isn't persistent on a third-party server. If a client asks "can you keep it available longer?" — that's a legitimate excuse to send a second, time-limited link, which doubles as a download confirmation.

Passwords and how to share them

A password on the transfer link should never travel in the same medium as the link. Email the link; text or voice-call the password. This breaks the security fallacy of "the email inbox is the single point of compromise." For high-value clients (mergers, litigation, HR), use Signal or a password-manager shared vault entry (1Password Shared, Bitwarden Organization).

The password should be strong enough that a brute-force attack on the ciphertext is infeasible. With AES-256-GCM and a PBKDF2 key-derivation of 600,000 iterations, a 12-character random password (roughly 75 bits of entropy) takes centuries to crack on commodity GPU clusters. Use a generator — 1Password, pwgen, or the service's built-in one.

The delivery email template

Subject: Deliverable — Acme Website Launch v3 (expires 24 Apr)

Hi Sophie,

Final deliverables are ready. Download link below (valid until
Friday 24 April). I'll text you the password separately.

  [transfer URL]

Contents:
  01_Source          — Figma + PSD masters
  02_Exports         — logo set, favicons
  03_Deliverable_PDFs — Brand Guide v3

Let me know if you want me to walk through any section.

— Julien

Short, explicit, professional. No "please find attached" boilerplate. No "hope this helps."

End-to-end encryption for regulated industries

If the client is a law firm, hospital, bank, or EU-based GDPR controller, encryption at rest on a third-party server is not enough. You want client-side (browser-side) encryption, where the transfer service's servers never see plaintext. AES-256-GCM in the browser, keyed from a password only you and the client know, via the Web Crypto API's crypto.subtle.

HexaTransfer runs this pipeline by default — the file is encrypted in your browser before upload. The server stores ciphertext and a 128-bit authentication tag. For a GDPR data protection impact assessment (DPIA), that's the difference between "processor has access" and "zero-knowledge transit."

Tracking downloads and confirming delivery

Download notifications (emails or dashboard) tell you when the client opened the link. If a deadline is on Friday at 5 PM and the download hasn't happened by Thursday, you send a polite reminder before the weekend eats the conversation. This is the single most under-used feature in professional file delivery.

Comparison for client deliverables

| Service | Max size | Expiry | Password | Download tracking | E2E encryption | | --- | --- | --- | --- | --- | --- | | Email attachment | 25 MB | Indefinite in inbox | No | Read receipt (unreliable) | No | | Dropbox Transfer (paid) | 100 GB | Up to 90 days | Yes | Yes | No | | WeTransfer Pro | 20 GB | Up to 365 days | Yes | Yes | No | | SwissTransfer | 50 GB | 1–30 days | Yes | Basic | At rest | | HexaTransfer | 10 GB | Configurable | Yes | Yes | Yes (AES-256-GCM in-browser) |

Edge cases: agencies sending to multiple stakeholders

If a deliverable is going to a brand manager, a CMO, and a legal reviewer at the same client, send the single link with a password to the project lead and ask them to forward internally. Sending three separate emails with three separate links is amateur — it fragments the conversation and creates three files to clean up at expiry.

Professional delivery is a conversation about trust, not a file-size war.

Try it at hexatransfer.com — free, no account, 10 GB max.