How clients can send documents without creating an account

The business asking for the documents creates a request and sends the client a link. The client needs nothing but a browser. Dropbox file requests, WeTransfer requests and document request tools such as ShieldFive all work this way.

For sensitive documents such as IDs, tax forms and bank statements, pick a link that encrypts each file in the client’s browser before upload, so only you can open it and the service stores ciphertext. With ShieldFive, the client also types a PIN you send separately; they never give an email address.

1. Create a free ShieldFive account. This is the only account involved, and it holds the keys that open the files.

2. Create a request and list the documents you need, one per line. You can start from a template, for example the US Form 1040, Form I-130 or I-485 checklists, or a mortgage application.

3. Set a PIN of at least four characters and when the link expires: up to 7 days on the free plan; 30 or 90 days, or never, on Firm seats.

4. Send the link by email or message, and the PIN by a different channel. ShieldFive does not email the link for you: part of the decryption key is in the link itself and never reaches our servers.

5. You get an email when files arrive. Open them in your browser.

1. Opens the link on a phone, tablet or computer, in any current browser.

2. Types the PIN.

3. Sees the list of documents you asked for, picks the files or takes photos, and sends. Each file and its name is encrypted in the browser before it is uploaded.

There is no sign-in, no app and no email address to confirm. The help article on document requests shows the same flow from inside the product, including what to do if a chat app cuts the link short.

Dropbox says the person uploading does not need a Dropbox account but “may be prompted to enter your name and email address” (Dropbox: responding to a file request) and that it “doesn’t offer client-side encryption” (Dropbox: how security works). WeTransfer says everyone uploading to a request “has to verify their email address first” (WeTransfer: request files). Google says responders to a file-upload question “need to sign in to a Google Account” (Google Forms: file upload). The upload link comparison covers free-tier limits, expiry and notifications for each.

For a one-off video or design file that is not sensitive, a transfer service is simpler: no PIN to pass on.

Chasing is light. On Firm seats (and during the trial), if you add the client’s email, ShieldFive reminds them at most twice, after about three and seven days, while required items are missing. The reminder cannot contain the upload link, because the decryption key never reaches our server, so it points the client back to the link you sent. You also get a reminder to follow up. Your firm name and logo appear on the upload page on the paid plan and during the 14-day trial.

You need a free ShieldFive account to create requests; only the client skips signup. After the 14-day trial, the free plan allows 1 open request at a time, links last up to 7 days and client reminders stop. Firm seats (€29 per seat per month or €290 per year) add unlimited open requests, automatic client reminders, your logo, and links that stay open up to 90 days or with no expiry. Clients never pay.

Like any web app, we serve the JavaScript that does the encryption. The guarantee is “encrypted in the client’s browser, ciphertext at rest”, not a claim that no compromised server could ever interfere. The request security page sets out the threat model.