How to Password Protect a Dropbox Link and Where It Falls Short for Video
Dropbox locks link passwords and expiry dates behind its paid plans. The clicks to set both, how to send the password without undoing it, and what a password never gave a video team in the first place.
Dropbox links to client cuts, in my experience, mostly go out with no password on them at all, and to be very honest the editors sending them aren't careless people, right, they've just decided the risk is small because the client seems nice and the cut is only MV1. The ones who do try to password protect a Dropbox link usually find out the night before an embargoed teaser goes out that the option is greyed out on their free Basic account.
Plenty of the freelancers my agency hires keep their whole business in Dropbox, raw footage, project files, exports, invoices and so on, and for storing and moving files it's really really good. What running an editing agency and a review product side by side has taught me is that a password on a file link solves one narrow problem, strangers opening the file, and leaves the rest of client review exactly as messy as it was.
So this one comes in two halves, right, the practical half on which plans give you a Dropbox shared link password and an expiration date, the clicks to set both and how to send the password safely, and then the honest half on what that password never gave a video team in the first place.
Which Dropbox plans let you add a password to a shared link
Dropbox keeps link passwords and link expiry on its paid plans, and the free Basic account doesn't get them, which is exactly what freelancers hit when they open link settings and find the controls locked, so if you're after Dropbox password protection on a free account, there's no hidden menu that switches it on.
The catch here is that the paid tiers don't all get the same extras, for instance the option to switch downloads off on a link, and Dropbox reshuffles its plans every so often. So before you upgrade just for this, check Dropbox's plan comparison for both the password and the expiry date on your tier, right, because you'll want both.
If you're staying on Basic, the workarounds are not equal. An encrypted zip uploaded to Dropbox works, but your client has to download and extract the whole thing before pressing play. Third party sites that put a password page in front of a Dropbox link also turn up in this search, and with any of them I'd check where the browser lands once the password is accepted, because if it's the ordinary Dropbox address, anyone who copies it has your cut with no password at all. The last option is a review tool with password links on every plan, which is where this post ends up.
On Dropbox Basic the password and expiry controls in link settings are locked, so you either upgrade or put the cut behind a different kind of protected link.
How to set a Dropbox link password and expiration date
On a paid account it takes about a minute, though Dropbox moves its labels around now and then. On dropbox.com you hover over the video, click Share, create or copy the link so it exists, and open the link settings behind the small gear icon next to it. Inside, you switch on a password and type it, pick an expiration date, flip the download toggle if your tier has one, and click Save.
From the desktop app it's the same settings reached another way, right, you right click the file in your Dropbox folder in Finder or File Explorer, choose Share, and open link settings from there. Password protecting a Dropbox folder works the same way from the folder's own link settings, and everything inside sits behind it.
The date you pick matters more than people think, so let me walk through a worked example. Say you're a freelancer cutting a 60 second launch teaser for a skincare brand that's under embargo until 20 October, MV1 goes out on 3 October as a 600 MB H.264 export, and notes are due on 7 October. Most people set the expiry to the embargo date, which is backwards, right, because the embargo is when the world may see it, while the link only needs to live until the client has given notes. I'd set it for 9 October, two days of slack after the deadline, and send MV2 on its own fresh link.
The last step is the one everyone skips, so open the link in a private window where you're not signed in and check it actually asks for the password. That test also shows you what the client gets, a password page before anything loads, then the video in Dropbox's browser preview with a download button unless you switched downloads off, so I add one line to the email saying the link will ask for a password, because clients who've never seen that box sometimes reply that it's broken.
To change the password later you go back to the same link settings, type a new one and save, and anyone opening the link after that needs the new one. When a round closes I'm pretty sure deleting the link from that same menu is the cleaner move, since a deleted link can't be forwarded anywhere.
What a Dropbox password actually protects
A password on a Dropbox link is basically a gate on that one link, and the word "that" is where most of the pitfalls live. The password sits on the link, not the file, so if you shared the parent folder with the client last month as an ordinary folder link, that older link still opens the new teaser with no password. It's very very common to see the file link locked carefully while the folder link sits wide open in a three week old email.
The second thing is that the password is shared rather than personal. When the marketing lead passes it to her founder and the founder passes it to the agency running their paid social, the password tells you nothing about who typed it, and you can't cut one of them off without changing it for everyone, the client included.
The third thing is the download, right. A password decides who opens the link and does nothing about the copy that leaves once someone clicks download, and a 600 MB MP4 sitting on somebody's laptop has no password on it and no expiry date, and it certainly doesn't know the launch is embargoed.
Some Dropbox tiers do show link traffic or who viewed a file, and what that tells you depends on your plan and whether the viewer was signed in, but the password itself stays one key that everybody shares. So it covers the moment you send the link and very little after that, does that make sense, right.
A password on a Dropbox link keeps strangers out of that one link, and it cannot tell you which person typed it or which older link is still wide open.
Where it falls short for client video review
Now the part most guides skip, because they're written for documents and PDFs, where a password and an expiry date really are most of what you need, while a video cut starts a conversation that runs three or four rounds and the password doesn't change how it happens.
What I see with the freelancers we work with, and saw in my own agency before we moved review off storage links, is that the client downloads the file, watches it in whatever player opens, and sends notes over email or WhatsApp like "around 1:10 the logo feels small". Then "around 1:10" turns out to be 1:14, which at a frame rate of 25 frames a second is a hundred frames of guessing, and the editor spends ten minutes scrubbing the timeline in Adobe Premiere Pro before fixing anything. MV2 means a new file, a new link and, done properly, a new password, so by MV3 the client has three links and teaser_final_v2_REAL.mp4 in their downloads, and nobody is completely sure which one they approved.
To be fair to Dropbox, it does let people comment on files, and it has a separate review product called Replay, laid out in my PlayPause vs Dropbox Replay comparison. A password on a plain file link is still a storage feature though, and in my experience clients who get a storage link treat it like a download and reply by email.
At the end of the day the password did its job perfectly in that teaser story, right, nobody outside the client saw the cut, and the round still dragged, because the password was never the slow part.
in my agency the client downloaded the cut, sent notes by email with rough timecodes, and every version needed a new link
the client watches in the browser, clicks the exact frame to comment, and each new version stacks on the same card
Sending the password without undoing the protection
Whatever tool you use, the password is only as good as the way it travels, and since most of my clients review from home or on the road, remote work basically means the link moves through inboxes and chat groups you'll never see. The most common mistake I see, right, is the link and the password in the same email, so anyone that email gets forwarded to holds both halves of the key. The link goes by email and the password goes by a different channel, a WhatsApp to the one person signing off or read out on the kickoff call.
Use a long passphrase, four random words is plenty, rather than the brand name plus the year, which is the first thing anyone guesses. Ask the client to request access for colleagues instead of forwarding the password, and when someone on their side leaves mid-project, change the password or make a fresh link that day, and trust me on any level, that one habit saves more awkward calls than the password itself.
Forwarding is the leak I see most, so I'd write the rule into your client feedback SOP once instead of repeating it per project, and the wider picture is in sharing a video securely for review. If you're weighing Vimeo instead, Vimeo private link vs password has the tradeoffs.
- Send the link and the password on different channels
- Use a passphrase of four random words, not the brand name
- Give each client and each round its own password
- Ask the client to request access instead of forwarding
- Change the password the day someone leaves the project
Password protected review links built for video
Now run the same skincare teaser through PlayPause, right, so it stays concrete. You upload MV1, create a share link, switch on the password, and send the link by email and the password by WhatsApp. Password protected links come on every plan, including Creator at $9 a month, so there's no greyed out box waiting for you the night before a launch.
The client opens the link in a browser with no account and no install, and it plays from a streaming copy, so your original file is never touched. When the logo feels small they click that exact frame, leave a comment that sticks to it, and draw on the frame to show where the logo should sit. Who-watched analytics shows who opened the link, when, and from which city, so when the founder and the paid social agency both turn up you actually know, and revoking the link is instant if something gets forwarded too far.
When MV2 is ready you upload it onto the same card as a version stack, so the client sees MV1 and MV2 in one place instead of juggling links and passwords. Link lifetimes follow the plan, 30 days on Creator, 90 days on Agency and never expiring on Enterprise, and Enterprise also adds a custom share domain such as review.yourbrand.com, all of which is laid out on the sharing and security page.
One honest note for freelancers, files on Creator expire after 30 days, so Dropbox stays your archive and PlayPause is where review happens, and for handing over the final I'd use a Dropbox Transfer alternative. The exact clicks live in password protecting a review link, and the freelancer setup is on secure share links for freelance editors. You see what I mean here, right, the password becomes one step in a round that also knows who watched and where each note belongs.
Frequently asked questions
Can I password protect a Dropbox link on a free account?
No, a free Dropbox Basic account can't add a password or an expiration date to a shared link, because those controls sit on the paid plans. On Basic, your workarounds are an encrypted zip the client has to download and extract before watching, or a review tool like PlayPause, where password protected links come on every plan starting with Creator at $9 a month.
Can I password protect a Dropbox folder instead of a single file?
Yes, on a paid plan you share the folder, open that folder link's settings and set a password there, and everything inside sits behind it. The catch is that each link carries its own settings, so an older link to a file inside, or to the parent folder, doesn't pick up the new password, so check which links exist before assuming the folder is locked.
What happens when a Dropbox link expiration date passes?
The link stops opening for everyone, your client included, and the file stays in your Dropbox untouched. That's why I set expiry a couple of days after the notes are due rather than on a launch or embargo date. If the client comes back after it lapses, create a fresh link with a new password instead of extending the old one, so you always know which link belongs to which round.
Does a Dropbox password stop my client from downloading the video?
No, a password decides who can open the link, and once someone is in, they can download unless your tier offers a setting to switch downloads off and you've turned it on. Even then, a screen recorded copy carries no password and no expiry. For client review I'd rather the client watch in a browser player, comment on frames, and only receive the file at final delivery.
If you're tired of greyed out settings and one password per version, take a look at the PlayPause pricing page and send your next cut through the 7-day free trial with a password protected link and frame comments.
So yeah. That's my way of saying it.
Saumyajit co-founded PlayPause after years watching review and approval quietly eat creative teams' deadlines. He writes about the workflow side of video, feedback, versioning, and getting to a clean sign-off.
Related resources
Keep reading
Bring your team into one review space
Centralize feedback, lock approvals, and deliver faster, start free today.
Sign Up for Free