Skip to content
xaweho

Knowledge base · basic

Securing sharing links — password, expiration date, file drop

Protecting public sharing links: password protection, expiration date, limiting permissions. Plus file drop for upload-only recipients.

basic ·

An open sharing link is a URL anyone with the link can use. For sensitive content, that’s often not what you want — here are the protection options Nextcloud offers.

When creating or editing a public link:

  1. In the Sharing tab → select the link → Advanced options.
  2. Check Password protect.
  3. Set a password.

How the recipient experiences it: they get the link, click it, see a password entry page, enter the password, see the content.

Important: send the link and the password separately — link by mail, password by messenger or phone. If both land in the same mail account and the account is compromised, the password protects nothing.

Setting an expiration date

In the same dialog:

  1. Check Set expiration date.
  2. Pick a date.

After expiry, the link is dead — a 404 for anyone who opens it.

Our recommendation: set an expiration date for every share. 14 days is a good default. If the recipient needs longer, they’ll ask — then you extend it or send a new link.

Server-wide, as an admin you can enforce a maximum expiration date — see Sharing internally and externally.

The different permission modes

In the sharing-link details you can choose:

  • Read + download: default — recipient sees the content, can download.
  • Upload and edit: recipient can add new files and change existing ones.
  • File drop: recipient can only upload, doesn’t see the content (not even other uploads).
  • Hide download: content viewable only, file not downloadable (for preview shares).

File drop in detail

File drop is very useful for cases where you don’t want recipients to see what others uploaded:

  • Job-application inbox: every applicant uploads their CV, sees no others
  • Photo inbox for an event: guests upload photos, don’t see each other’s
  • Anonymous file handover: a whistleblower-style drop box

Setup: in the sharing dialog, enable Allow upload + disable Read. When recipients open the link, they see an empty upload form.

You can have multiple links for the same file — say, one for “read with password”, another for “edit with a longer validity”.

+ Add link in the Sharing tab → a new link with its own settings.

Our recommendation: one link per recipient group, each with its own settings. That way you can delete individual links deliberately without affecting other recipients.

A note for the recipient

When creating a sharing link, you can add a welcome note shown to the recipient when they open the link:

  • “Hi, here are the documents I promised. You can download everything; you got the password by SMS. Any questions, let me know.”

Useful because the recipient doesn’t have to guess what they’re looking at and what to do.

In the Files app: click the sharing icon in the detail sidebar → you see all shares for the file. Including all active public links.

Per link:

  • Edit to change settings
  • Delete to revoke immediately
  • Copy link to share again

Setting server-wide protection defaults

As an admin, in Administration settings → Sharing, you can enforce defaults:

  • Password requirement for all public links: on
  • Maximum expiration date: 30 days (or less)
  • Suggest a default expiration date: 14 days

That way users can’t create unprotected links anymore — and all shares expire automatically after 30 days.

Our recommendation for sensitive sectors (medical practices, law firms, public authorities):

  • Password requirement: on
  • Maximum expiration date: 14 days
  • Audit logging: on (via the admin_audit app)

The sharing audit log

If audit compliance matters, activate the Auditing / Logging app in the app store. All sharing actions are then logged:

  • Who shared what, when, with whom
  • Who opened a shared link
  • Who revoked a share

Logs are visible in Administration settings → Logging or as a file on the server.

Federated sharing — protecting federated shares

For shares to other Nextcloud servers (federated):

  • The default is to allow them.
  • You can restrict to a whitelist of known federated servers.
  • You can enable “federated sharing only where you have an account yourself” — more secure, but operationally harder.

Configurable in Administration settings → Sharing → Federated Cloud Sharing.

Frequently asked questions

What if I forget the password of a sharing link? As an admin, you can set a new one in the sharing dialog — the recipient then needs the new password.

Are share recipients notified? With federated sharing: yes, a notification appears in the recipient’s Nextcloud. With public links: no, the recipient only gets the link.

Can I monitor public-link accesses? With the Audit Log app, yes — see above. Otherwise not. By default, Nextcloud records that the link was accessed, but not from which IP.

Can sharing links be encrypted? The link itself is HTTPS. Content on the server: that depends on whether you’ve enabled server-side encryption (a dedicated article on end-to-end encryption is coming).

What happens after repeated wrong password entries? After 5 attempts, the IP is blocked for a while — brute-force protection. Configurable in Administration settings → Security.

Can recipients leave their email address, so I know who uploaded what? With file drop mode + an appropriately configured app, yes. Without apps: no, uploads are anonymous (no login on the public page).

What’s next

Tags
nextcloud sharing links passwort

Did this article help?

If not, open a ticket. If it did, we're happy about a referral — both sides get €25 credit on their customer account.