Design Links That Expire

Trust, Privacy & Ethics · privacy, security, permissions

Updated 2026-08-04

Understand that a share link, often a pre-signed URL, is a credential. Anyone holding it gets in, so the only real controls are how long it lasts and how narrow it is.
Show the expiry at the moment of sharing, and let it be chosen. A link that lasts forever by default is the setting that leaks quietly for years.
State the scope in the sharing interface. One file, view only, until Friday is a sentence the sharer can check before they paste it into a channel.
Design the expired state as an explanation rather than an error. This link expired on 12 March. Ask the owner for a new one. with a request button is recoverable, and a bare 404 is not.
Distinguish expired from revoked from never valid. They send the recipient to three different actions and are usually rendered as the same page.
List active links somewhere and let each be revoked. A share that cannot be found later cannot be withdrawn later.
Say whether the link works without signing in. An unauthenticated link forwards to anyone, and the sharer should know that before choosing it over an invitation.
Keep expiry short for anything sensitive and long for anything convenient. A payment receipt and a marketing asset do not need the same rules, and a single default serves neither well.
Watch where links end up. Addresses appear in browser history, chat logs, and referrer headers, so a link is a secret in one of the least secret places available.

A link that never expires is a permission you granted once and can no longer see.