Dropbox can contain personal documents, photographs, financial records, work files and other information you cannot afford to expose or lose. Secure the account, devices, sharing permissions and recovery options that protect those files.
A secure Dropbox account also requires protected devices, careful sharing permissions, strong two-step verification and a recovery plan for when something goes wrong.
Work through these checks one at a time. Start with authentication, then review devices, file sharing and recovery.
Your Dropbox password is the first line of protection for your stored files. Make it strong, unique and private.
VERIFY: Confirm that your Dropbox password is unique and known only to you.
Two-step verification adds another authentication factor so that your password alone is not enough to access the account.
VERIFY: Confirm that two-step verification is enabled and that you can still access your chosen authentication method.
An authenticator app can generate verification codes without depending entirely on SMS messages.
VERIFY: Test the authenticator before relying on it as your primary second factor.
A compatible security key can provide a strong authentication method that is resistant to many common phishing attacks.
VERIFY: Test the security key before depending on it as your only second factor.
Recovery codes can help when you lose access to your normal two-step verification method.
VERIFY: Confirm that you can recover your account if your normal authentication device is lost.
Computers and mobile devices connected to Dropbox may have access to synchronized files.
VERIFY: Every connected device should be one you recognize and still control.
An active browser session can provide access to your Dropbox even if you are not actively using the service.
VERIFY: Confirm that every active Dropbox session belongs to you.
Applications connected to Dropbox may have permission to access account information or files.
VERIFY: Every application with Dropbox access should have a purpose you recognize.
A file can be secure inside your account but exposed through a shared folder or link.
VERIFY: Every person with access to an important file should still have a legitimate reason to access it.
A shared link can continue exposing information after the original reason for sharing has disappeared.
VERIFY: Confirm that every active shared link is intentional and still necessary.
People who only need to read a document should not automatically receive permission to edit it.
VERIFY: Every collaborator should have only the access needed to complete their task.
A shared folder can expose many files at once, making folder membership especially important.
VERIFY: Confirm that sensitive information is not stored inside an unnecessarily broad shared folder.
Dropbox may contain passports, identity documents, financial records, certificates, photographs and work information.
VERIFY: Know which files would cause the greatest harm if another person gained access to them.
When Dropbox synchronizes files to a computer, those files also exist locally on that computer.
VERIFY: Remember that a synchronized Dropbox folder is also data stored locally on the computer.
A phone signed in to Dropbox can provide access to your cloud files.
VERIFY: Confirm that someone who finds your phone cannot immediately access your Dropbox files.
Scammers can imitate Dropbox notifications and use fake sign-in pages to steal credentials.
VERIFY: Verify the message and destination independently before signing in.
Attackers may impersonate technical support and ask for passwords, verification codes or remote access.
VERIFY: A genuine security problem should not require you to surrender your password or authentication code to a stranger.
Recovery information becomes especially important when you lose access to your normal device or authentication method.
VERIFY: Confirm that your recovery path still works before you actually need it.
Dropbox provides tools that can help recover deleted or changed files, depending on your account and plan.
VERIFY: Know your recovery options before a file is accidentally deleted or changed.
Cloud storage should not be the only place where irreplaceable information exists.
VERIFY: Ask yourself: if my Dropbox account became unavailable today, would I still have a safe copy of my most important files?
A lost device may contain synchronized Dropbox files or an active Dropbox session.
VERIFY: Treat a lost device containing synchronized Dropbox files as a cloud-security incident.
A compromised Dropbox account can expose files, shared folders and sensitive documents, so respond quickly.
VERIFY: Do not stop after changing your Dropbox password. Review the account, devices, applications and files.
If you find an unfamiliar login, changed recovery information, unexpected security alerts or another sign that someone may have accessed your account, stop the normal security check and move to the recovery process.
I think my account is compromised →If you have worked through the relevant settings and something still looks wrong, do not give your security secrets to someone promising to fix the account. Use the service's official support and recovery resources for service-specific account problems.
For broader cybersecurity problems, you can also use the professional assistance pathway on this platform.
Need Professional Help? →Review important account settings periodically, especially after a password change, device change, suspicious message or unexpected login alert.
VERIFY BEFORE YOU TRUST.
← Back to Secure Your Accounts