· FlingDrop Team · Security · 5 min read
Access Codes, Download Limits and Kill Switches for Your Links
A share link is only as private as the inbox it lands in. FlingDrop now lets you lock a download behind a 6-digit code or your own password, cap how many times it can be downloaded, and switch any link off instantly.
A temporary download link solves most of what is wrong with email attachments: the file expires, it does not sit on a mail server forever, and the recipient does not need an account. But a link has one weakness that expiration alone does not fix — anyone who has the link can open it.
Links get forwarded. They get pasted into a group chat. They get quoted in a reply that includes three people who were not on the original thread. Once that happens, expiration is a slow fix: the file stays reachable until the clock runs out.
FlingDrop now gives you a set of controls that work on the link itself, so a leaked URL is no longer the same thing as a leaked file.
Access codes: a second thing the recipient has to know
When you upload a file, you can require an access code. FlingDrop generates a 6-digit code and shows it to you once, next to the link. You send the link the way you always did — email, chat, ticket system — and deliver the code through a different channel: a text message, a phone call, a message in a different app.
The recipient opens the link and sees a short page asking for the code. Enter it, and the download starts. No account, no signup, nothing to install — the experience recipients like about FlingDrop is unchanged.
What changes is what a leaked link is worth. If the URL ends up in the wrong inbox, the file is still locked.
You can also set your own password instead of the generated code. Useful when you already share a passphrase with a client or a partner and want to reuse it. A password you choose is stored one-way, so nobody — including us — can read it back to you; if you forget it, you set a new one and re-share. The generated 6-digit code works differently: you can look it up again in your dashboard whenever the recipient says they lost it.
Wrong guesses lock the file, not just slow it down
Six digits is a million combinations, which is plenty when guessing is expensive. So FlingDrop makes it expensive:
- 5 wrong attempts and the file locks for 15 minutes.
- 20 wrong attempts and it stays locked until you unlock it yourself.
- Every failed attempt is recorded, with a timestamp, so you can see if someone has been poking at your link.
That last point matters more than it sounds. Most people never find out that a share link was probed. With FlingDrop you open the file in your dashboard and see it.
Download limits: a link that retires itself
Expiration is a deadline. A download limit is a different idea: the link stops working once the file has actually been collected.
Set the limit to 1 and you get a link that works exactly once. Set it to 3 for a small team. Once the count is reached, the link is dead — even if there are still three weeks left on the expiration window.
This is the control you want for anything you send to one specific person. If the file is downloaded twice when you set a limit of one, you know something is wrong.
Disable a link, or replace it
Two more controls, for after the fact.
Disable link is a kill switch. One click and the link is dead: anyone who opens it sees the same “not available” page they would see after expiration. Click again to bring it back. This is what you reach for the moment you realize you pasted a link in the wrong channel.
Regenerate link gives the file a brand-new URL and retires the old one. Same file, same upload, different address — useful when you want a specific person to lose access while everyone you re-send the new link to keeps it.
Set your defaults once
You should not have to remember to tick a box on every upload.
Every member of a team can set their own upload default: if you always send contracts, turn access codes on and every file you upload is protected unless you say otherwise. The same setting exists on API keys, so an integration that pushes payroll files can require a code while your general-purpose key does not.
And if a team needs it as policy rather than preference, an owner or admin can set the tenant-wide rule: Required means every file protected, no exceptions; Disabled turns the feature off entirely; Optional — the default — leaves the choice to each person on each upload.
Everywhere you already upload
These options are available wherever FlingDrop is:
- Web dashboard — a checkbox and a password field on the upload form.
- Windows client — right-click a file, and the client remembers your default.
- CLI —
--protectfor a generated code,--passwordfor your own, and--codewhen downloading a protected file. - REST API — request protection at upload time and receive the code once in the response.
What this does not change
Files still expire automatically. Recipients still never need an account. Links are still generated with enough randomness that guessing a valid one is not a realistic attack.
Access codes are for a threat the link length was never going to solve: the link getting somewhere you did not intend. Now, when that happens, you have something to do about it.
Every plan includes these controls, including Free. Create an account and try it on your next upload — or read our guide on sending large files securely for the wider picture.
