An open sharing link is a URL anyone with the link can use. For sensitive content, that’s often not what you want — here are the protection options Nextcloud offers.
Sharing link with a password
When creating or editing a public link:
- In the Sharing tab → select the link → Advanced options.
- Check Password protect.
- Set a password.
How the recipient experiences it: they get the link, click it, see a password entry page, enter the password, see the content.
Important: send the link and the password separately — link by mail, password by messenger or phone. If both land in the same mail account and the account is compromised, the password protects nothing.
Setting an expiration date
In the same dialog:
- Check Set expiration date.
- Pick a date.
After expiry, the link is dead — a 404 for anyone who opens it.
Our recommendation: set an expiration date for every share. 14 days is a good default. If the recipient needs longer, they’ll ask — then you extend it or send a new link.
Server-wide, as an admin you can enforce a maximum expiration date — see Sharing internally and externally.
The different permission modes
In the sharing-link details you can choose:
- Read + download: default — recipient sees the content, can download.
- Upload and edit: recipient can add new files and change existing ones.
- File drop: recipient can only upload, doesn’t see the content (not even other uploads).
- Hide download: content viewable only, file not downloadable (for preview shares).
File drop in detail
File drop is very useful for cases where you don’t want recipients to see what others uploaded:
- Job-application inbox: every applicant uploads their CV, sees no others
- Photo inbox for an event: guests upload photos, don’t see each other’s
- Anonymous file handover: a whistleblower-style drop box
Setup: in the sharing dialog, enable Allow upload + disable Read. When recipients open the link, they see an empty upload form.
Multiple links for the same file
You can have multiple links for the same file — say, one for “read with password”, another for “edit with a longer validity”.
+ Add link in the Sharing tab → a new link with its own settings.
Our recommendation: one link per recipient group, each with its own settings. That way you can delete individual links deliberately without affecting other recipients.
A note for the recipient
When creating a sharing link, you can add a welcome note shown to the recipient when they open the link:
- “Hi, here are the documents I promised. You can download everything; you got the password by SMS. Any questions, let me know.”
Useful because the recipient doesn’t have to guess what they’re looking at and what to do.
Managing the sharing-link list
In the Files app: click the sharing icon in the detail sidebar → you see all shares for the file. Including all active public links.
Per link:
- Edit to change settings
- Delete to revoke immediately
- Copy link to share again
Setting server-wide protection defaults
As an admin, in Administration settings → Sharing, you can enforce defaults:
- Password requirement for all public links: on
- Maximum expiration date: 30 days (or less)
- Suggest a default expiration date: 14 days
That way users can’t create unprotected links anymore — and all shares expire automatically after 30 days.
Our recommendation for sensitive sectors (medical practices, law firms, public authorities):
- Password requirement: on
- Maximum expiration date: 14 days
- Audit logging: on (via the
admin_auditapp)
The sharing audit log
If audit compliance matters, activate the Auditing / Logging app in the app store. All sharing actions are then logged:
- Who shared what, when, with whom
- Who opened a shared link
- Who revoked a share
Logs are visible in Administration settings → Logging or as a file on the server.
Federated sharing — protecting federated shares
For shares to other Nextcloud servers (federated):
- The default is to allow them.
- You can restrict to a whitelist of known federated servers.
- You can enable “federated sharing only where you have an account yourself” — more secure, but operationally harder.
Configurable in Administration settings → Sharing → Federated Cloud Sharing.
Frequently asked questions
What if I forget the password of a sharing link? As an admin, you can set a new one in the sharing dialog — the recipient then needs the new password.
Are share recipients notified? With federated sharing: yes, a notification appears in the recipient’s Nextcloud. With public links: no, the recipient only gets the link.
Can I monitor public-link accesses? With the Audit Log app, yes — see above. Otherwise not. By default, Nextcloud records that the link was accessed, but not from which IP.
Can sharing links be encrypted? The link itself is HTTPS. Content on the server: that depends on whether you’ve enabled server-side encryption (a dedicated article on end-to-end encryption is coming).
What happens after repeated wrong password entries? After 5 attempts, the IP is blocked for a while — brute-force protection. Configurable in Administration settings → Security.
Can recipients leave their email address, so I know who uploaded what? With file drop mode + an appropriately configured app, yes. Without apps: no, uploads are anonymous (no login on the public page).
What’s next
First login as a Nextcloud admin
What to do after your Nextcloud is provisioned — login, profile, the important first settings, what we handle and what you handle.
Admin GUI overview — what you'll find where
Nextcloud's administration settings are big. Here's a tour of the sections that matter and what they do.
Creating users and groups
Create users for family, club or team, organize groups, set quotas, control login behavior.
Sharing — files with others, internally and externally
Sharing files in Nextcloud — within your cloud with other users, with groups, or externally via sharing link.