If you share a file with “anyone who has the link,” you may be giving access to people beyond the person you meant to reach. Safer sharing starts with choosing the smallest audience and the least powerful permission that will let recipients do their task. This guide explains when to use view, comment, or edit access; how to limit link sharing; what to check when sharing folders; and how to review or remove access after sending.
Match each person’s permission to the task
Most file-sharing services offer some version of three permissions: view, comment, and edit. The labels and exact controls vary, but the principle is the same: give recipients only the abilities they need. Someone who only needs to read a draft usually does not need permission to change it.
Use view access for reference material, final documents, and files recipients should not alter. Choose comment access when you want feedback without allowing changes to the main text. Use edit access for collaborators who need to revise the file, add information, or manage its contents.
For example, if you are sending a project brief to a client for approval, view access may be enough; comment access is more suitable if you want them to flag changes. If a colleague is responsible for updating the brief, edit access makes sense. Before choosing, ask: “What action does this person need to take?” If the answer is only “read it,” do not default to editing.
Be especially careful with edit permission on shared folders. Depending on the service and folder setup, editors may be able to add, move, or remove files—not just change the document you had in mind. If someone needs to update one file, sharing that file rather than its containing folder can reduce the chance of exposing or altering other materials.
Share with named people when the audience is known
When you know who needs the file, invite those people using their individual email addresses or accounts. This creates a clearer access list than a link that works for anyone who obtains it. It also makes later cleanup easier: you can identify a recipient and remove that person without having to replace a widely distributed link.
Before sending an invitation, check the address carefully. A typo, an old work address, or a similarly named contact can send access to the wrong person. If the file contains sensitive material, confirm that the recipient can open it through the intended account; an invitation to a personal address may not be appropriate for work or client documents.
Some services let you choose whether invited people can reshare the file or change permissions. If you do not need recipients to manage access, leave those capabilities off where the service allows it. A reviewer who needs to comment is not automatically someone who should be able to invite additional viewers.
Named access is not a guarantee that a recipient will keep the file private. A person who can view a document may still be able to copy its contents, photograph the screen, or pass information along. Permission settings control access through the service; they cannot fully control what an authorized recipient does with information they can see.
Use a link only when it solves a real sharing problem
A link can be convenient when the audience is large, changing, or difficult to list individually. But link settings differ: a link may be limited to named people, people in an organization, or anyone who has it. Choose the narrowest option that works for the recipients, rather than assuming that “link sharing” means access is private.
For a document intended for a small known group, use a link restricted to invited accounts if the service supports it. For a public handout, a broader link may be reasonable, but consider whether the document contains names, contact details, internal notes, or other information that should not be public. If you choose an “anyone with the link” setting, treat the link like a transferable key: anyone who receives or forwards it may be able to open the file, subject to the service’s settings.
A useful check is to read the sharing panel’s audience description before copying the link. Confirm both who can open it and what they can do. A link limited to your organization but set to “edit” may still be too broad; a view-only link open to anyone may be inappropriate for confidential material. These are separate choices, and both matter.
Avoid posting a broadly accessible link in a public page, group chat, or social post unless public access is intentional. If you need to share the same material with different audiences, make separate copies or links with different permissions rather than giving everyone the most permissive setting.
Check the folder before sharing a file inside it
A document’s access can be affected by the folder it lives in. A folder may already be shared with a team, or its permissions may apply to files placed inside it. As a result, changing the document’s own sharing settings may not be enough to understand who can reach it.
Before sharing a file, inspect its current access list and the access rules for its parent folder. Look for inherited permissions, organization-wide access, or groups whose membership you do not recognize. If you cannot narrow access on a single file because the folder’s rules are broader, consider moving a copy into a more restricted location—while checking that the move will not disrupt other collaborators or workflows.
This matters in ordinary situations, not just highly confidential ones. Imagine you have a folder shared with a project team and place a document containing a client’s private comments in it. Sending that document to one person may leave the whole team able to see it, depending on the folder’s setup. Check the audience shown in the service, not only the person you are about to invite.
Also check whether recipients can see other files in the folder. If they only need one document, sharing the individual file is often simpler and reduces accidental exposure. If they need a set of materials, create a dedicated folder containing only those items and share that folder with the appropriate audience.
Reduce exposure before and after sending
Some services offer extra controls such as link expiration, download restrictions, or limits on resharing. Use them when they fit the task, but treat them as additional safeguards rather than complete protection. Availability may depend on the service, account type, or administrator settings.
An expiration date can be useful for a temporary review or event document, provided recipients know when access will end. Download restrictions may discourage casual saving, but they cannot prevent every form of copying; someone who can view content may still reproduce it another way. If a document must remain confidential, consider whether sharing the full content is appropriate at all, or whether a redacted version would meet the need.
After sending, reopen the sharing settings and confirm the result. Check that the intended people are listed, the permission level is correct, and the link audience matches your choice. If the document is sensitive, you can test the link in a private browser window or with an account that is not already signed in—but do not use a real recipient’s account or disclose the link to someone else just to test it.
When the task is finished, remove access that is no longer needed. You may be able to remove individual people, disable a link, or change access to a more restrictive setting. If you sent the wrong link or discovered that it was too broad, change or disable it promptly, then create a correctly restricted link and send that one to the intended recipients.
Choose a sharing method by audience and purpose
The right setup depends on who needs the file and what they need to do. For a small group working together, named invitations with individual edit or comment permissions are usually easier to manage. For a broad audience receiving a final handout, a view-only link may be more practical—provided the content is suitable for that audience.
Use this quick decision process:
- Identify the audience. If you can name the recipients, invite them individually. If the audience is open or changing, decide whether a broader link is truly necessary.
- Choose the task permission. Reading calls for view access; feedback calls for comment access; direct collaboration calls for edit access.
- Check surrounding access. Review folder permissions and existing links so the file is not exposed through another route.
- Set a time limit if useful. For temporary access, use an expiration option if available and compatible with the work.
- Review after sharing. Confirm the access list and remove access when the reason for sharing has ended.
A common mistake is to choose the broadest setting because it avoids recipient access problems. That may solve the immediate inconvenience but create a larger audience than intended. If a recipient cannot open a restricted link, first confirm which account they are using and whether the invitation went to that address. Broaden access only if the original restriction cannot meet the actual need.
Frequently Asked Questions
Can I tell whether someone opened or downloaded a shared file?
Some services provide activity or access information, but the details vary by platform, file type, and account settings. Do not assume that a lack of visible activity means nobody saw the content. If knowing who accessed a file is important, check the service’s audit or activity features before sharing and confirm what they record.
Will removing someone’s access delete a copy they already downloaded?
Usually, changing the online permissions affects access to the shared file, not copies a recipient has already downloaded, printed, or otherwise saved. If you need to correct information that has already been shared, contact the recipient and explain what should happen to their copy. For sensitive material, consider that limitation before granting access.
Why can’t a recipient open a link after I shared it?
They may be signed into a different account from the one you invited, or the link may be restricted to a particular organization or set of people. Ask which account they are using, then compare it with the address in the file’s access list. Avoid switching to a public link as the first fix; correct the account or invitation if possible.
Does a password-protected link make a file safe to share publicly?
A password can add a barrier, but it does not make a broadly distributed file private. The password itself can be forwarded, and an authorized viewer may still copy the contents. Use password protection as one control among others, and avoid sharing sensitive material through a public link when named access or another method would better limit the audience.
Make a final permissions check before you send
Before sending the next file, pause at the sharing panel and verify four things: the audience, the permission level, any folder-level access, and whether the link should expire or be disabled later. Then send the file and revisit its access list once the recipient’s task is complete. If you are unsure whether the intended audience can be narrowed, ask your organization’s IT or security team how its sharing settings work before making the file public or broadly accessible.
