Most guides on protecting a file sent by email talk about encrypted ZIPs or third-party software, built for a one-off exchange between individuals. For a recurring client delivery (photo, video, brand content), the same logic applies, but the right habit changes: protect the delivery itself, not just the file.
The basic rule: never send the password in the same message
Whether you're encrypting a ZIP or password-protecting a delivery page, the rule doesn't change: the password never travels in the same email or message as the link. Send it through a different channel (text, a call, a separate messaging app). A password pasted right under the link protects nothing at all.
Why a protected page beats an encrypted ZIP
An encrypted ZIP protects the file, but forces the client to handle the process themselves (unzipping, entering the password in the right piece of software), which creates friction and messages like "it won't open on my end". A password-protected delivery page does the same job with no technical fuss for the client: they enter the password once, in their browser, and get into their gallery like normal.
xFer builds this password protection right into the delivery page, on top of the private, unindexed link and automatic expiry. Three simple layers instead of a compressed file to pick apart.
When to protect it, and when not to bother
Not every delivery needs a password: a public photo gallery meant to be shared around the family doesn't need one. On the other hand, a video edit the client hasn't approved yet, a portfolio meant for a single agency, or embargoed brand content deserve that extra layer.
The right test: ask yourself what happens if the link falls into the wrong hands. If the answer worries you even a little, protect the delivery.
In short
Never put the password in the same message as the link, choose a protected page over an encrypted ZIP to spare your client the friction, and save this extra layer for deliveries that really need it.