A free, secure upload link for clients, without a client account

For one large file that is not sensitive, such as a video or a design export, a free transfer service or a Dropbox file request is the simpler choice, and most clients have used one.

For identity documents, tax records, bank statements, medical or legal material, the deciding question is who can read the upload once it is stored. Every free transfer and file request service checked here encrypts files in transit, and most encrypt them at rest with keys they manage, so the provider can read them. An encrypted request link encrypts each file in the client’s browser to a key only you hold, so the provider stores ciphertext.

Email needs no account and costs nothing, which is why clients default to it. The file then sits readable in the client’s sent folder, in your inbox, on both mail providers’ servers and in their backups. There is no expiry and nothing to revoke: a copy stays in each mailbox until someone deletes it. You are notified in the sense that the email arrives, and size limits are whatever the two mail providers allow.

WeTransfer has a file request feature. Uploaders do not need a WeTransfer account, but WeTransfer’s help centre says everyone who uploads to a request “has to verify their email address first”, and you get an email after each upload. Files uploaded through a request expire after 3 days if you are on the Free or Starter plan, and after up to 30 days on Ultimate or Teams (WeTransfer: request files). The Free plan allows sending up to 10 transfers or 3 GB in any rolling 30 days (WeTransfer plan limits).

WeTransfer encrypts files in transit with TLS and at rest with AES-256. Its help centre says it does not review your transfers except with your consent, to investigate terms-of-service violations or where the law requires it (WeTransfer: how we protect your files), which describes provider-held keys: WeTransfer can decrypt.

Filemail lets people send you files “without requiring them to register”, through a file request, a personal upload page or an embeddable form (Filemail: receive large files). On the free Basic plan a sender needs only the email address you signed up with; transfers are up to 5 GB, files are available for up to 7 days, and you get 2 transfer sessions per 24 hours (Filemail Basic).

Filemail’s help centre states that data at rest “is not encrypted unless the user asks for end to end encryption at the point of sending” (Filemail: encryption in transit and at rest). Its end-to-end encryption is on the Business plan only and is documented for sending from Filemail Desktop, not for receiving (Filemail: end-to-end encryption).

Dropbox File Request is available on every Dropbox plan, including the free Basic plan. The uploader does not need a Dropbox account but may be asked for a name and email address (Dropbox: responding to a file request). You get an email whenever a file is uploaded, can add an optional password, and can close the request so the link stops accepting uploads; deadlines need Professional or a business plan. On Basic, Plus and Family each file can be up to 2 GB, and collected files take up space in your Dropbox (Dropbox: create a file request), which on Basic is 2 GB in total (Dropbox Basic).

Dropbox encrypts files in transit with TLS and at rest with AES-256, and states that it “doesn’t offer client-side encryption” (Dropbox: how security works). The service can read what your clients upload.

A Google Form with a file-upload question is free but fails the no-account test: Google’s documentation says responders “need to sign in to a Google Account”, and uploads land in a new folder in the form owner’s Drive (Google Forms: file upload). You can turn on email notifications for new responses, and stop accepting responses or set a close date (Google Forms: manage responses).

Portals built for accountants, lawyers and agencies organise requests per client and track what is outstanding. They are rarely free. Content Snare, for example, has no free plan: it starts at $35 per month billed annually ($42 monthly) after a 14-day trial, clients open a link without creating an account, and every plan includes unlimited automatic reminders to clients (Content Snare pricing). If clients forgetting is your main problem, that is worth paying for.

For sensitive intake, check the portal’s security documentation for one specific claim: that files are encrypted on the client’s device to a key only you hold. Many describe encryption in transit and at rest, which leaves the provider able to read the files.

An encrypted request link looks the same to the client as a file request: open a link, add files, no account. The difference is that the browser encrypts each file before it is uploaded, to a key the provider does not hold, so the service stores ciphertext. Vendors differ on who holds the key and what the uploader must give; the encrypted file request tools comparison goes through them one by one.

ShieldFive document requests work this way. You send the client one link and a PIN by a separate channel. The client uploads from a phone or computer without creating an account or giving an email address. Each file and its filename is encrypted in the client’s browser to your public key, a hybrid of ML-KEM-1024 and X25519, the server stores only ciphertext, and you decrypt in your own browser.

One large, non-sensitive file, once: use a transfer service or a Dropbox file request. They are free, clients know them, and end-to-end encryption would add a step for no benefit.

Documents you would not want a third party to read: use a link that encrypts in the client’s browser to a key only you hold, and check that the provider’s documentation says so for received files, not only for files you send.

Clients who forget: a portal with automatic client reminders will save more time than anything else here. Some firms use an encrypted request link for the sensitive items and a portal for the rest.

Whatever you use, send any PIN or password by a different channel from the link, close or expire the link when the intake is done, and list exactly which documents you need so the client does not send extras. The guide to collecting documents from clients covers the workflow in more detail.

Chasing is light. On Firm seats (and during the trial), if you add the client’s email, ShieldFive reminds them at most twice, after about three and seven days, while required items are missing. The reminder cannot contain the upload link, because the decryption key never reaches our server, so it points the client back to the link you sent. You also get a reminder to follow up. Your firm name and logo appear on the upload page on the paid plan and during the 14-day trial.

Your firm name and logo appear on the upload page on the paid plan and during the 14-day trial. There are no recurring requests; you create a new request each time. Every link needs a PIN of at least four characters, which you share with the client separately, so the client has one more thing to enter than with a plain transfer link.

You need a free ShieldFive account to create requests and hold the keys; only the client skips signup. After the 14-day trial, the free plan allows 1 open request at a time, links last up to 7 days and client reminders stop. Firm seats (€29 per seat per month or €290 per year) add unlimited open requests, automatic client reminders, your logo, and links that stay open up to 90 days or with no expiry. Clients never pay.

Like any web app, we serve the JavaScript that does the encryption. The guarantee is “encrypted in the client’s browser, ciphertext at rest”, not a claim that no compromised server could ever interfere. The request security page sets out the threat model.