How to use password-protected transfers correctly
Passwords are only as strong as your habits around them. Five rules that make the feature actually useful.
Adding a password to a SendMe transfer is great defence-in-depth — even if the 6-digit code leaks, the file stays locked. But password protection works only when you follow a few simple rules.
Rule 1 — Use a different channel for the password
If you text the code and the password in the same message, you've gained nothing. Text the code, voice-call the password. Email the code, Signal the password. Different channels, different attack surfaces.
Rule 2 — Make it at least 8 characters
We require 4 characters at minimum, but real-world attackers can try millions of combinations per second. Eight characters with a mix of letters and digits is the practical floor. Twelve characters is comfortable.
Rule 3 — Don't reuse passwords
Each transfer should get a fresh password. Reusing one across multiple transfers means one leak compromises all of them. A password manager makes this trivially easy.
Rule 4 — Tell the receiver verbally if possible
Spoken passwords don't leave a written trail. For ultra-sensitive transfers (think medical or financial), a 30-second phone call is hard to beat.
Rule 5 — Combine with short expiry
A password is a lock; expiry is the lock being thrown away. Combining a 1-hour expiry with a strong password gives you both: nobody can crack the password in time, and after an hour the file no longer exists.
What happens if I forget the password?
We don't store your password in clear text — only a bcrypt hash. If you forget, the only options are (a) re-upload the file and pick a new password, or (b) ask the receiver to also try. We cannot recover or reset it.