Beyond PPAP: a safe way to send files
PPAP is the common practice of emailing a password-protected ZIP and then sending the password in a follow-up email — over the same channel. Once seen as a safeguard, it is now considered unsafe, and governments and companies are moving away from it.
Why PPAP is being retired
- No channel separation: the file and its password travel the same email path, so anyone who can read the mail gets both — like leaving the key under the doormat.
- It evades malware scanning: an encrypted ZIP can't be inspected, so it is a common malware vector. Many organizations now reject such attachments.
- Extra work for the recipient: unzip and type a password, awkward on phones, and impossible to automate.
- Fragile against misdelivery: send it to the wrong address and the password goes to the same wrong person.
What a safe alternative needs
- Channel separation: share the file link and the password by different means.
- Encryption: encrypted in transit and at rest, unreadable even to the provider (end-to-end encryption).
- Limits and auto-deletion: available only for as long, and as many downloads, as needed.
- No account required for the other party.
How Secufile replaces PPAP
Secufile is a free, secure file-transfer service that meets these conditions and works as a drop-in replacement for password-protected ZIPs — no sign-up.
- Files are encrypted in your browser before they leave your device. Choose E2EE and neither the key nor the password ever reaches the server.
- Send the link to the recipient and share the password over a separate channel — a call, in person, another app.
- Set a retention period and download limit; files are deleted automatically when they expire.
- You can also ask someone to send files to you (a receive folder): they need no password, and only you can open what arrives.
How to use it (3 steps)
- Drag and drop your files.
- Set the retention and download limit, then upload.
- Send the link, and share the password by another means.
See the how-to guide and the FAQ for details.
In short
PPAP sends the file and its password over the same channel and hides content from malware scanners, so it is no longer safe. Secufile — encryption, channel separation, and auto-deletion — lets you send files more safely, for free and without an account.