Dropbox

Is Dropbox safe?

Dropbox is safe enough for everyday files, but it gives you less privacy than its main rivals. We found no fines against it, and it runs a public bug bounty and publishes its incidents in detail. Against that, the iPhone app declares data used to track you across other companies' apps and websites, personal plans have no end-to-end encryptionEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary, and attackers got in twice in the last four years: through employees' GitHub logins in 2022 and through Dropbox Sign in 2024. We score Dropbox 63/100, below OneDrive (66) and Google Drive (70).

The breaches: 2012, 2022 and 2024

2012. In August 2016 Dropbox confirmed that a list of about 68 million email addresses with hashed and salted passwords, taken in 2012, was real. It reset the passwords of users who had not changed theirs since mid-2012. This is more than 10 years old, so it does not count against the score, but it is why Dropbox passwords from that era still appear in breach lists.

2022. In early October 2022 employees received phishing emails posing as CircleCI, a developer tool. Some entered their GitHub password and a one-time code from their hardware key on a fake page. The attacker copied 130 code repositories, which held some developer API keys and a few thousand names and email addresses of employees, customers, sales leads and vendors. GitHub alerted Dropbox on 14 October. Dropbox said the repositories did not contain its core app code and no one's files or passwords were accessed.

2024. On 24 April 2024 Dropbox found an attacker inside Dropbox Sign, the e-signature service it bought as HelloSign. The intruder had compromised an automated service account and reached the customer database. Dropbox's SEC filing says the attacker accessed emails, user names and account settings for all Sign users, and for some users phone numbers, hashed passwords, API keys, OAuth tokens and multi-factor authenticationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary data. Dropbox found no access to documents or payment details and says the main Dropbox service was not affected. It reset passwords, logged users out and rotated keys.

None of these exposed stored files. Two of them do show that Dropbox's own people and service accounts have been the weak point.

Is Dropbox end-to-end encrypted?

Not for most people. Files are encrypted at rest, but Dropbox holds the keys. End-to-end encryptionEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary exists only for team folders on the Business Plus, Advanced and Enterprise plans. Its own help page lists the limits: metadata stays in plain text, the feature does not work in the mobile app, files copied out of the folder lose their encryption, and you cannot recover data without a recovery key. Personal plans get nothing comparable. For that, look at iCloud with Advanced Data Protection or Proton Drive.

What Dropbox does with your data

The App Store label is the bluntest in this group. Under "Data Used to Track You" it lists purchases, identifiers, usage data and other data. It also lists purchase history, email, name and IDs for Dropbox's own marketing, and search history and advertising data for analytics. Google Drive and OneDrive declare no tracking.

The policy is more reassuring on sale: Dropbox says it "won't sell" your information to advertisers or other third parties. But its privacy FAQ goes further than the label suggests. It says Dropbox may build models that identify keywords and topics "trained on your documents and metadata" for search, sorting and summaries, and may use machine learning on "the content of their files" among other signals to find users to market premium plans to. OpenAI appears on its list of third-party processors. The AI principles promise no generative AI models trained on customer content without consent. Dropbox Dash, its AI search tool, imports the last 90 days of browser history, including page content, when you install it.

How to use Dropbox safely

1. Turn on two-step verificationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary and use a password you use nowhere else.
2. Refuse tracking if iOS asks whether Dropbox may track you, or block tracking requests for all apps in iPhone privacy settings.
3. Encrypt sensitive files yourself before uploading, since personal plans have no end-to-end option.
4. Review your shared links and delete the ones you no longer need.
5. Be wary of emails saying someone shared a Dropbox file with you; open Dropbox directly to check.
6. If you used Dropbox Sign, make sure any password you reused there has been changed elsewhere.

How we scored it

The regulatory record (88) is Dropbox's strongest factor: no fines or orders found. Privacy (50) is the weakest, because the app declares tracking and the FAQ allows training models on your documents. Security (62) credits encryption at rest and a public bug bounty but counts the 2022 and 2024 incidents and the missing end-to-end option for personal plans.