Every share link you've ever created is in one of two states: it still works, or it doesn't. That sounds obvious, but it's the whole security story. A link that still works can be opened by anyone who finds it - Today, next month, or in 2031. A link that has expired is just dead text.

Most people worry about the wrong thing. They worry about someone guessing their link (nearly impossible with a good random URL) and never think about the link simply outliving its purpose. Your client needed the file for two days. The link works for two years. Those extra 728 days are pure risk with zero benefit. It raises a question worth answering head-on - do shared files stay online forever? - Because with the wrong setup, they effectively can.

This article makes the case for expiry as a security feature - With numbers, a comparison table, and practical advice on picking lifetimes.

Key takeaways

  • A file your client needed for two days behind a link that works for two years is 728 days of pure risk with zero benefit.
  • One forwarded link turned a single recipient into 16 people; a 24-hour link turns all 16 copies into dead text tomorrow.
  • A permanent link's attack window is forever, while an expiring one is capped at 1 hour to 7 days - The default on ShareIt.onl.
  • Pick the shortest lifetime that works: 1 hour for live handoffs, 24 hours as the everyday default, 7 days for slow recipients.

People sometimes argue against expiring links because of "link rot" - The frustration of clicking an old link and finding nothing. Fair enough: a dead link costs someone thirty seconds and a follow-up message.

But flip it around. A live old link costs you control. "Link risk" is the mirror image of link rot: the longer a link stays valid, the more places it spreads and the more ways it can surface in front of someone it was never meant for. For a file transfer - As opposed to, say, a public blog post - The file's useful life is usually measured in hours or days. After that, rot is exactly what you want.

The question isn't "how do I keep links alive?" It's "how fast can this link die once its job is done?"

Here's the uncomfortable part: once you send a link, you no longer control where it goes. Realistic example - You email a salary spreadsheet link to one HR colleague. She forwards it to a manager "for a quick look." He pastes it into a team chat. That chat has 14 members, two of whom leave the company next quarter but keep their message history synced on personal devices.

Your one recipient just became 16, and you've never heard of most of them. With a permanent link, every one of those copies works indefinitely. With a 24-hour link, all 16 copies turn into dead text tomorrow. You can't stop forwarding - But expiry means forwarding stops mattering.

Permanent links don't just spread - They get archived. They sit in email accounts for years, and email accounts get breached constantly: billions of messages have been exposed in credential dumps over the past decade. Researchers have repeatedly found working cloud-drive and file-share links inside leaked mailboxes and pastebin dumps, some pointing to files shared five or more years earlier and still downloadable.

Other places old links resurface:

  • Sold or recycled laptops and phones with synced mail and chat history.
  • Departing employees who keep access to old team channels or export their inbox.
  • Backup archives of chat platforms, restored years later.
  • Browser history sync on a shared family computer.

None of these require a hacker to target you. They just require your link to still be alive when someone stumbles across it. For a deeper look at where the files themselves sit during all this, see what really happens to files after you share them.

Expiry Shrinks the Attack Window

Security people talk about the "attack window": the period during which something can go wrong. A permanent link has an attack window of forever minus zero. Every day it exists, the odds of exposure tick up a little - Another forward, another backup, another breach.

An expiring link caps the window mathematically. A 24-hour link shared at 9 a.m. Monday cannot be exposed by an email breach in August, because there's nothing left to expose. The file behind it is deleted; the URL returns nothing. On ShareIt.onl, this is the default behavior, not an option you dig for: every upload (up to 10 files, 200 MB total) gets a lifetime of 1 hour, 12 hours, 24 hours, 3 days, or 7 days, and the files are deleted when it ends.

Permanent link Expiring link
Attack window Unlimited - Years Capped at 1 hour to 7 days
Risk from forwarding Every copy works forever All copies die together
Exposure via old email breaches High - Links found years later still work None after expiry
Requires cleanup discipline Yes - You must remember to revoke No - Cleanup is automatic
Recipient convenience Can download anytime Must download within the window
Best for Public content meant to stay up Person-to-person file transfers

That last row is the honest trade-off: expiring links ask your recipient to act within a window. For a file transfer, that's rarely a real cost - Most shared files are downloaded within the first day anyway.

Choosing the Right Lifetime

Shortest expiry that still gets the job done - That's the rule. A practical mapping:

  • 1 hour - Live handoffs: you're on a call, moving a file between your own devices, or the recipient is waiting right now.
  • 24 hours - The everyday default: "here's the file, grab it today."
  • 3 days - A couple of days of slack for a mid-week hand-off.
  • 7 days - The ceiling: busy clients, group shares, slow-moving approvals, or recipients in other time zones you truly can't schedule.

Tip: When you're torn between two lifetimes, pick the shorter one. Most shared files are downloaded within the first day, and re-uploading on a no-signup tool takes under a minute if someone misses the window.

If you're torn between two options, pick the shorter one; re-uploading takes under a minute on a no-signup tool. We break down the decision in more detail in how long should a share link last, and expiry is just one layer of a sensible setup - The full picture is in our secure file sharing guide.

FAQ

What actually happens when a share link expires?
On an expiry-based service, the files behind the link are deleted from the server and the URL stops resolving to anything. Anyone clicking an old copy of the link - Including someone who found it in a leaked inbox - Gets an error page, not your file.
Can't I just delete a permanent link manually instead?
You can, if the service allows it and you remember to do it. In practice almost nobody goes back to revoke old links, which is exactly why researchers keep finding years-old working links in breach data. Automatic expiry removes the need for discipline.
Isn't a random unguessable URL enough protection on its own?
Randomness stops guessing, but most link exposure isn't guessing - It's forwarding, breaches, and old archives, where the attacker has the exact URL. Expiry is the only defense that works after the link has already leaked.
What if my recipient misses the download window?
You re-share, which takes about a minute: upload again, pick an expiry, send the new link. That small occasional cost buys you the guarantee that no forgotten link is sitting alive in someone's inbox three years from now.