How secure is Dropbox?

Dropbox offers a number of security features to protect your data, like end-to-end en­cryp­tion, per­mis­sions, two-factor au­then­ti­ca­tion and geo-re­dun­dan­cy.

How Dropbox security looks in a nutshell

• Dropbox offers 256-bit en­cryp­tion as well as SSL/TLS and AES-128-bit en­cryp­tion for uploads and downloads.
• Ad­di­tion­al security features include two-factor au­then­ti­ca­tion, Box­cryp­tor com­pat­i­bil­i­ty, Perfect Forward Secrecy, cer­tifi­cate pinning and geo-redundant data centers.
• Two potential drawbacks regarding data pro­tec­tion and sov­er­eign­ty: Dropbox reserves the right to limit access to user data as outlined in its terms of service. Ad­di­tion­al­ly, it is subject to the U.S. Cloud Act, which, according to some experts, may conflict with the European GDPR, even though Dropbox claims to comply with GDPR reg­u­la­tions.

What en­cryp­tion tech­nolo­gies does Dropbox use?

The en­cryp­tion methods used for data at rest are es­pe­cial­ly relevant for companies that outsource third-party servers. As one of the oldest and most well-known cloud services, Dropbox offers com­pre­hen­sive en­cryp­tion of your cloud data.

Dropbox uses the following en­cryp­tion tech­nolo­gies:

AES-256-bit en­cryp­tion

Dropbox’s security is off to a good start with modern AES-256-bit en­cryp­tion for all cloud data. The Advanced En­cryp­tion Standard is one of the most secure en­cryp­tion tech­nolo­gies out there and is even used by the U.S. gov­ern­ment. To get a sense of just how secure it is: It would take several billion years to crack even the “weaker” 128-bit en­cryp­tion. So 256-bit guar­an­tees reliable pro­tec­tion against brute force attacks.

TLS/SSL and 128-bit en­cryp­tion

Of course, it’s important that data is protected not just at rest in the cloud but also during uploads and downloads. That’s why Dropbox uses TLS and SSL en­cryp­tion, short for “Secure Sockets Layer” and “Transport Layer Security”. That means your data is trans­ferred through a secure tunnel with AES-128-bit en­cryp­tion, meaning that it’s virtually im­pos­si­ble to intercept and decrypt your data in transit.

Zero-knowledge en­cryp­tion with Box­cryp­tor

Zero knowledge means that you encrypt your data before uploading it to the cloud, making it un­read­able for the cloud service. For client-side en­cryp­tion, Dropbox im­ple­ments zero-knowledge en­cryp­tion natively using tech­nol­o­gy from the German company Box­cryp­tor. Dropbox acquired the company in 2022.

What access rights does Dropbox have?

Before you use a cloud service, you should take a look at their terms and con­di­tions. That will quickly make clear what access rights the cloud service reserves. Dropbox, for example, mentions limited access to data stored on the server.

Which sharing and access rights do users have?

In addition to limited access to your data, the security of your cloud data also depends on the options for sharing files with others. It’s important that you can determine yourself who can see which files and who can’t.

Dropbox offers more or less the same sharing per­mis­sions as most Dropbox al­ter­na­tives. For each file or folder, you can specify who has access to it, share a link with them and revoke these per­mis­sions whenever you want. You can also decide whether each person has read-only access or can also edit files.

Does Dropbox have two-factor au­then­ti­ca­tion?

You can also increase the security of your Dropbox account with optional two-factor au­then­ti­ca­tion (2FA). 2FA requires both a password and a security code that you receive via SMS or an au­then­ti­ca­tor app like Google Au­then­ti­ca­tor. Two-step ver­i­fi­ca­tion is a standard offered by pretty much every reputable service for sharing, storing and editing data. On Dropbox, you’ll need to enable the feature in your account.

How does account recovery work?

Whether you forgot your password, your account was hacked or you ac­ci­den­tal­ly deleted your account – account recovery is an important part of cloud security. In Dropbox Basic and Dropbox Plus, you can request to recover a file or account for 30 days. With sub­scrip­tion levels like Es­sen­tials or Business you have up to 180 days to recover your data, and with Business Plus you have up to 365 days.

What security measures does Dropbox offer against cyber attacks?

If you store data in cloud services, you have to rely on these companies to take suf­fi­cient security measures against cyber attacks. Similar to Google Drive and iCloud, Dropbox offers high cloud security with the following measures against cyber attacks:

• High data center security with geo-re­dun­dan­cy
• Modern en­cryp­tion with AES-256-bit for data in rest
• TLS en­cryp­tion with AES-128-bit for data in transit
• In­te­grat­ed password pro­tec­tion with a secure password
• Optional two-factor au­then­ti­ca­tion
• Automatic, syn­chro­nized data backups
• Account and file recovery
• Perfect Forward Secrecy (prevents later de­cryp­tion of data using session keys that cannot be re­con­struct­ed)
• Cer­tifi­cate pinning (ensures that con­nec­tions are only made to au­tho­rized servers)

Despite all of these security measures, Dropbox has one important weak point: Uploads and downloads are not scanned for viruses and malware.

Known security incidents at Dropbox

As a cloud service that’s existed since 2008, Dropbox in­evitably has some security incidents in its history. Some of the most well-known ones include:

• In 2011, an update error resulted in all Dropbox accounts being ac­ces­si­ble with their email address alone for several hours.
• In 2012, a Dropbox employee’s account was com­pro­mised, leading to the pub­li­ca­tion of over 68 million users’ data, including email addresses and passwords. The security breach demon­strat­ed that Dropbox employees’ access to data continues to pose a security risk.
• In 2017, files dating back as far as 6 years re-appeared in users’ accounts. The incident showed that Dropbox does not per­ma­nent­ly delete data deleted by users.
• In 2022, it became known that around 130 repos­i­to­ries of source code were stolen using a com­pro­mised employee account. The stolen source code included internal pro­to­types, security tools and copies of libraries.
• In 2024, attackers gained access to the Dropbox Sign pro­duc­tion en­vi­ron­ment and were able to steal customers’ personal data.

Is the Cloud Act relevant for Dropbox?

Dropbox is a U.S.-based company whose cloud servers are located primarily in the U.S., making it subject to the Cloud Act. The law passed in 2018 and grants au­thor­i­ties almost un­re­strict­ed access to the cloud data of U.S. companies. Dropbox is thus required to hand over user data, re­gard­less of where that user is located. A court order is not always required. That means that complete data pro­tec­tion is not possible with Dropbox.

Does Dropbox meet data pro­tec­tion standards for companies?

When it comes to data security and data sov­er­eign­ty, companies need to ask them­selves whether Dropbox is suitable for business use. Generally, Dropbox meets the most important re­quire­ments for com­pli­ance and data pro­tec­tion with state-of-the-art en­cryp­tion, access control and important cer­ti­fi­ca­tions. Cer­ti­fi­ca­tions that it offers include:

• ISO 27017 (cloud security)
• ISO 27018 (cloud privacy and data pro­tec­tion)
• CSA STAR Level 2 (Cloud Security Alliance: Security, Trust, Assurance, Risk registry)

Like Google Drive and iCloud servers, Dropbox offers a solid security standard that is com­pat­i­ble with business use. However, the fact that it is subject to the Cloud Act is a major drawback in terms of security.

Summary: Is Dropbox secure?

In con­clu­sion, Dropbox offers a high level of cloud security with its modern en­cryp­tion, secure data centers and zero-knowledge en­cryp­tion. However, past security incidents, unclear employee access to data and the Cloud Act mean that Dropbox is not the ideal cloud service for highly sensitive, critical company data.

If you’re wondering which cloud is the most secure, pay attention to which data pro­tec­tion guide­lines the cloud service is subject to. In this case, Dropbox does not meet the high standard of the European GDPR, for example, and is instead subject to data sharing re­quire­ments in the Cloud Act.