How long should a download link last?

Most people set an expiry once, leave it on whatever the default was, and never think about it again. It is the most under-used control in file sharing, and the one that quietly does the most work.

A link that has stopped resolving cannot be forwarded, leaked, found in an old inbox, or pulled out of a breached account. Expiry is the only security measure that keeps working after you have lost track of where the link went.

Why links outlive their purpose

A share link does not stay where you put it. It gets forwarded to a colleague who "just needs to see this". It gets pasted into a group chat with forty people. It sits in a mailbox that is still signed in on a laptop that is later sold, or in an account whose password turns up in a credential dump three years later.

None of that is unusual, and none of it is preventable at the moment you send. What is preventable is the link still working when it happens.

The question is not "who am I sending this to?" It is "what happens if this link is still live in a year, in a place I did not put it?"

A window per job

Match the lifetime to the task rather than to a habit.

A day

The default for anything sensitive, and for anyone you are actively in conversation with. If they miss it, you send another one — that costs you ten seconds and is a feature, not a failure. Use it for identity documents, contracts, anything with financial or medical detail, and anything you would describe as confidential.

A week

The right answer for ordinary work. It survives a weekend, a time zone, a day off and a slow inbox, without leaving the door open for a month. If you are unsure, this is the one to pick.

A month

For something a group needs to get to in their own time: a set of assets going to several teams, footage a client will work through over a few weeks, files attached to a project with a real timeline. Long enough to be useful, short enough to still be a boundary.

Never

Only for a file you genuinely intend to publish — a download on a page, a release people will be linking to, a document that is meant to be public. If a link never expires, you have published the file, so decide that deliberately rather than arriving at it by leaving a default alone.

Short expiry is not paranoia, it is hygiene

People resist short windows because they imagine the recipient missing the file and the awkward follow-up. In practice, the vast majority of downloads happen within hours of the link being sent. A day covers almost every real case; a week covers essentially all of them.

The failure mode of a short expiry is a small, recoverable inconvenience. The failure mode of a long one is a file you have forgotten about being downloaded by someone you never met. Those are not the same size of mistake.

Expiry is not the same as revoking

Expiry is the schedule you set in advance. Revoking is what you do when something has gone wrong right now — the wrong recipient, the wrong version, a deal that fell through.

Both should be available, and revoking should be immediate: the files deleted and the link dead the moment you press it, with no window in which it half works. Setting a sensible expiry does not mean you never need to revoke; it means the number of live links you would ever have to think about revoking stays small.

What "expired" should mean

This is worth checking on any service, because there are two very different implementations behind the same word.

The weak version hides the link. The file is still on disk, still in a bucket, still restorable, and the promise is really "we have stopped showing this to people". The strong version deletes the bytes.

Here, expiry deletes. When a transfer's clock runs out the objects are removed and the link stops resolving; what survives is the record of it — the title, the file names, the download count — so your history still makes sense, with nothing left to download. That record is itself deleted after 90 days.

A short checklist

• Pick the shortest window that is actually workable, not the longest one you can justify.
• Treat a day as the default for anything you would not want read by a stranger.
• Reserve never for files you are deliberately publishing.
• Check what your provider means by expired — hidden or deleted.
• Revoke as soon as you know a link went somewhere it should not have. Do not wait for the expiry to do it for you.

Related: how to send large files compares the ways of getting the file across in the first place, and what end-to-end encryption actually means covers the other half of keeping a transfer private.