WeTransfer

Is WeTransfer safe?

WeTransfer is safe for what most people use it for: sending large photos, videos and design files that would not cause harm if a stranger saw them. Free transfers vanish within 3 days and files are encrypted on the way and at rest. It is a weaker choice for anything confidential, because WeTransfer holds the keys, the app tracks a device ID for advertising, and the brand is one of the most copied in phishing emails. We score WeTransfer 61/100, below Box (73) and Google Drive (70) and slightly above its sister app Remini (59).

Who runs WeTransfer now

WeTransfer started in Amsterdam and is still run by WeTransfer B.V. there. In July 2024 it was bought by Bending Spoons, the Italian company behind Evernote and Remini, which has cut deep into the staff of other companies it bought, Evernote among them. In September 2024 its chief executive, Luca Ferrari, said it planned to lay off 75% of WeTransfer's staff to create "a smaller, more sharply focused WeTransfer organization." WeTransfer's privacy contact is now a Bending Spoons data protection officer.

A smaller team does not make a service unsafe on its own. It does mean less public detail about how WeTransfer is run, and the July 2025 terms episode below came after the change of owner.

The July 2025 terms change

In July 2025 users noticed updated terms that gave WeTransfer a "perpetual, worldwide, non-exclusive, royalty-free, transferable, sub-licensable license" to use their files, including "to improve performance of machine learning models that enhance our content moderation process." Many creative professionals, WeTransfer's core users, read that as permission to train AI on their work.

WeTransfer said it does not use machine learning or any form of AI on shared content, that it had only considered AI for moderation, and that it would have left the wording out in hindsight. It removed the clause. The current terms, last updated on 3 August 2026, grant WeTransfer a royalty-free licence to use your content only for operating, developing and improving the service, in line with its privacy policy. That is a reasonable outcome, but the episode shows how much the terms can change with little notice.

What the app tracks

Apple's privacy label has a "Data Used to Track You" section listing a device ID. Your email, user ID, purchase history, usage and crash data, and the photos, videos and audio you send are linked to you for running the app, analytics and personalisation. Google Play says name, email, user IDs and purchase history are used for advertising or marketing, and that device IDs, app activity and crash data are shared with other companies.

The reason is the business model. WeTransfer shows ads from paying advertisers on its free service. The privacy policy says it receives "inferences" about your interests from advertising partners, shows personalised ads only with your consent, and may share a hashed email with ad partners if you allow it. It says it does not sell your data. It also says it reviews your files to spot trends only with your permission.

Security: what holds and what slipped

Files are encrypted in transit and at rest on Amazon Web Services, and accounts can use two-factor authenticationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary. WeTransfer holds the keys; end-to-end encryptionEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary is sold only on its Enterprise plan. A transfer without a password has no authentication at all: anyone who has the link can download the files until they expire. That is the design, so treat a WeTransfer link like a key, or add a password, which WeTransfer's pricing page lists for free accounts too.

The one known failure was in June 2019. On 16 and 17 June some WeTransfer service emails, and the transfers in them, went to the wrong people. WeTransfer blocked the affected links, logged some users out or made them reset passwords, and said the files had probably been opened only by the intended recipients. It never said publicly what caused it.

WeTransfer takes vulnerability reports through a HackerOne form and says it "may provide a financial reward" for accepted reports, at its own discretion.

Phishing and malware

The bigger risk comes from other people. Because WeTransfer emails are so familiar, criminals copy them, and some use real WeTransfer links because security filters trust the domain. In 2022 the email security firm Cofense traced a campaign that sent "proof of payment" files through WeTransfer, carrying Lampion, banking malware that overlays fake login forms on bank websites. WeTransfer says it uses automated tools, human moderators and user reports to remove malware, fraud and child abuse material.

How to use WeTransfer safely

1. Add a password to any transfer that matters, and encrypt confidential files before you send them.
2. Send transfers by link to the person directly rather than posting the link anywhere public.
3. Be suspicious of any WeTransfer email you did not expect, and never enter a password after clicking a download link.
4. Do not open scripts, archives or Office files with macros from a transfer you were not expecting.
5. Refuse tracking when iOS asks, and decline personalised ads in WeTransfer's cookie settings.

How we scored it

Regulatory record (87) is WeTransfer's strongest factor: we found no fines or orders, even after the 2019 incident, but no large regulator has reviewed it. Privacy (52) is the weakest, because the app tracks a device ID and the free service is funded by advertising. Scams and harmful content (58) reflects how often WeTransfer links and lookalike emails carry phishing and malware.