How to share your files and folders securely in Nextcloud

Sharing in Nextcloud lets you give other people access to selected files and folders while still retaining full control over your data. With passwords, ex­pi­ra­tion dates and precise per­mis­sions, you can share content securely with coworkers, teams, customers or external partners.

How does Nextcloud let you share files?

Nextcloud gives you several ways to share files and folders. You can share them in­ter­nal­ly with users and groups in your Nextcloud instance or ex­ter­nal­ly through public links.

Sharing with another user or group

Within the same or­ga­ni­za­tion, you can share files or entire folders directly with in­di­vid­ual Nextcloud users or groups. Internal sharing works well when teams keep documents in one shared place and update them together. For long-term team storage, Nextcloud group folders can also be useful. They are managed centrally and assigned to specific groups.

Because your shared file or folder is connected to specific user accounts, you can manage per­mis­sions much more easily than with a public link. Depending on your setup, you can give users different access rights when sharing in Nextcloud.

Important: When you share an entire folder, you also share all the files and sub­fold­ers inside it.

Public sharing

You can also share files and folders with people outside your Nextcloud instance. To do this, create a public share link. Nextcloud generates a link with a random token that gives re­cip­i­ents access to the shared file or folder. This is con­ve­nient, but public links should always be managed carefully.

How to share a folder in Nextcloud step by step

1. To share a folder in Nextcloud, select the folder and open the sharing options by clicking the share icon.

2. Then choose who should receive access: another user or group (internal share) or a public link (external share).

3. Choose the right level of access (such as, ‘View only’ or ‘Can edit’).

4. You can then set any custom per­mis­sions. For external shares, add a password and an ex­pi­ra­tion date.

Un­der­stand­ing inherited access when sharing a folder

When you share a folder in Nextcloud, re­cip­i­ents usually get access to all files and sub­fold­ers inside that folder too. Nextcloud calls this inherited access.

This is useful for shared work­spaces, but also means you need to check what a folder contains before you share it. This can become a problem when folder struc­tures grow over time. A project folder may start with harmless documents, but later contain quotes, contracts or personal data. For secure sharing in Nextcloud, only share folders when re­cip­i­ents really need access to every­thing inside them. If re­cip­i­ents only need certain files, share those files instead of the whole folder.

Review shared folders regularly, es­pe­cial­ly folders shared through public links or with people outside your or­ga­ni­za­tion.

How to share in­di­vid­ual files in Nextcloud

You can also share in­di­vid­ual files in Nextcloud instead of a whole folder. Here’s how it works:

1. Click the file you want to share.
2. Open the sharing options using the share icon.
3. Choose another user or group (internal) or a public link (external).

4. Choose the right access level.
5. Set any custom per­mis­sions. For public links, add a password and ex­pi­ra­tion date for added security.

Why share a single file instead of a folder?

If someone only needs one file, it is usually safer to share that file instead of the whole folder. That way, the person only gets access to the file you choose, not to other documents or sub­fold­ers. This follows the principle of least privilege: people only get access to the files they actually need instead of an entire folder.

This keeps per­mis­sions simpler and reduces the chance of sharing more than intended. It also means that files added to the original folder later are not au­to­mat­i­cal­ly shared later.

How can you secure public links in Nextcloud?

Public links are useful when you want to share files or folders with people who do not have an account in your Nextcloud instance. However, you should always secure public links. Nextcloud offers several ad­di­tion­al security options, including password pro­tec­tion and ex­pi­ra­tion dates.

Enabling password pro­tec­tion for public links

A secure password adds another layer of pro­tec­tion to a public link. Even if the link is forwarded by mistake or falls into the wrong hands, they still cannot open the shared file or folder without the password.

You can add a password in the “Custom per­mis­sions” area when you create the link. Always send the password sep­a­rate­ly from the link, for example by text, messenger or a separate email.

Ad­min­is­tra­tors can also set password rules for the whole instance. In the sharing settings, they can make Nextcloud ask for a password whenever someone creates a public link. They can also make passwords mandatory for all public links.

When sharing files or folders publicly, follow these guide­lines:

• Always use a password for public links.
• Send the password sep­a­rate­ly from the link.
• Avoid passwords that are easy to guess, es­pe­cial­ly for sensitive data.
• Make passwords mandatory server-wide if external sharing is used regularly.

Setting an ex­pi­ra­tion date for shared files or folders

An ex­pi­ra­tion date limits how long a file or folder is shared for. This is important because public links should not be ac­ces­si­ble forever. In Nextcloud, you can set an ex­pi­ra­tion date for public links. After that date, sharing is au­to­mat­i­cal­ly de­ac­ti­vat­ed.

When you share a file or folder, you can set an ex­pi­ra­tion date under “Custom per­mis­sions.” As with password pro­tec­tion, ad­min­is­tra­tors can require ex­pi­ra­tion dates to be set.

When setting ex­pi­ra­tion dates, you should take the following into account:

• Use short default durations for public links
• Make ex­pi­ra­tion dates mandatory for external shares
• Use shorter time frames for sensitive or personal data
• Enable no­ti­fi­ca­tions before an important shared file or folder expires

Nextcloud can also send no­ti­fi­ca­tions before a shared link expires. To use this feature, you can set up a server-side cron job that runs the OCC command sudo -E -u www-data php occ sharing:expiration-notification daily. Whoever shared the file or folder is then notified about any links that expire the following day.

Hide download

With “Hide download,” Nextcloud hides the download buttons and standard right-click options for public links. This is useful when external users should only be able to view files and not download a copy of them.

This option helps reduce unwanted downloads, but it does not stop someone from making copies of a file. They could still take a screen­shot or find other workarounds. Use Hide download’ as an extra safeguard, not as a sub­sti­tute for passwords, ex­pi­ra­tion dates or re­strict­ing per­mis­sions.

File drop

If external users only need to upload files, Nextcloud offers “File Drop” mode. They can add files to a shared folder without seeing what is already inside it. In current Nextcloud versions, you can usually set this up with Create file request in the plus menu (+). From there, you can add a title and de­scrip­tion, select the target folder and, if needed, set a password and ex­pi­ra­tion date. Users are also asked to enter their name before uploading, which makes it easier to match each file to the right person. The exact name and avail­abil­i­ty of this option can vary depending on your Nextcloud version and server setup.

Video ver­i­fi­ca­tion

For sharing highly sensitive data, Nextcloud can also add video ver­i­fi­ca­tion through Nextcloud Talk. With the “Password protect by Talk” option, re­cip­i­ents are asked to verify their identity in a video call before receiving the password. The password is usually given verbally during the call rather than sent in writing. For the video ver­i­fi­ca­tion option to appear, Nextcloud Talk must be installed and enabled.

Most everyday file sharing does not need this level of security. But for con­fi­den­tial business documents or personal data, it can be a useful safeguard before granting someone access.

How do per­mis­sions vary between file and folder sharing?

Per­mis­sions in Nextcloud depend on whether you share a whole folder or a single file:

How to share files and folders securely in Nextcloud

Nextcloud makes it easy to share files and folders, but it’s worth setting a few ground rules. This checklist helps you keep access limited, secure and easy to review:

✓ Use a password for public links.

✓ Set an ex­pi­ra­tion date for external access.

✓ Share folders only when people need access to every­thing inside them.

✓ Share in­di­vid­ual files when someone only needs access to specific in­for­ma­tion.

✓ Use “Hide download” as an extra safeguard for view-only access.

✓ Use “File Drop” or “File Request” when people should only be able to upload files, not view existing ones.

✓ Allow ‘Resharing’ only when re­cip­i­ents are allowed to share files or folders that have been shared with them.

✓ Review active links regularly and remove anything you no longer need.

✓ For sensitive data, keep ex­pi­ra­tion dates short and per­mis­sions limited.