Dropbox

Dropbox is a file sync service with a free plan of 2 GB and a Plus plan with 2 TB for one person.

Dropbox encrypts stored files but keeps the keys itself, and its terms say it “accesses, stores, and scans” your files to provide its features. That makes the sync, previews and search work well, and it means Dropbox, and anyone who can make it hand over data, can read what you store. End-to-end encryption exists only on team plans for three or more people.

Encryption & Key Custody

Dropbox splits each file into blocks and encrypts every block with 256-bit AES on its servers, and the apps send files over TLS. This encryption at rest protects files against a stolen disk. It does not keep them from Dropbox: its security overview says Dropbox “manages file encryption on users’ behalf” and that file keys are created and stored inside its own infrastructure. That is what key custody by the provider means in practice.

Dropbox’s servers open your files to make thumbnails and previews, recognize text in scans, index files for search and check content for violations of its rules, which Dropbox says it does with hash matching and human review. The terms extend this permission to “our affiliates and trusted third parties we work with”. There is no metadata encryption that keeps file names and types from Dropbox: they sit in a separate database that Dropbox reads to run sync and version history, and Dropbox also records file sizes, upload times and the people you share with.

Sharing works through Dropbox’s servers, so a shared folder or link gives no more protection than the rest of the account. A forgotten password is reset with a link sent to your email address, and the files are still there afterwards, because Dropbox holds the keys. That is the convenient side of account recovery by the provider; the other side is that anyone who takes over your email inbox can reach your files unless two-factor authentication is on.

End-to-end encryption exists, but not for individuals. Encrypted team folders are sold on the Advanced, Business Plus and Enterprise team plans, Advanced starting at three users. Only team admins can create them, the file names and other metadata stay readable to Dropbox, and shared links, previews, search, the Dropbox AI features and the mobile app do not work with them. The same plans add a key management option that uses a separate key per team, but those keys are still held in Dropbox’s infrastructure. On Basic and Plus there is no setting that moves the keys to you.

Trust & Transparency

The Dropbox apps and servers are closed source, and the terms forbid reverse engineering the apps. No security audit of the encryption is published. Dropbox’s Trust Center lists ISO/IEC 27001 and related certificates and SOC 2 reports for the year to 30 September 2025; Dropbox commissions them, and they cover how it runs its systems, not whether it can read your files. Penetration test reports are given only on request.

The privacy policy lists what Dropbox collects in any case: your name, email, phone number, payment details and address, file sizes, upload times and collaborators, sharing, editing, viewing and moving actions, and device data such as IP addresses and device identifiers. It describes no setting that turns off this usage collection, so the telemetry is always on. The privacy FAQ adds that Dropbox may train models on “your documents and metadata” for search, sorting and document summaries, and that it may use machine learning on “the content of their files” to pick users to market paid plans to. Dropbox says it does not sell personal data.

Dropbox’s AI features run on outside models. The Trust Center lists OpenAI models served through Microsoft Azure or by OpenAI, OpenAI’s GPT OSS 20B on Groq and Anthropic’s Claude through AWS Bedrock. It lists two controls for these features: no customer data is used to train third-party models, and data is kept for 90 days. Dropbox’s AI principles say it will not build generative AI models from customer content without consent. These are stated policies; nothing in the encryption keeps a document out of those features.

Users in the United States, Canada and Mexico contract with Dropbox, Inc. in San Francisco, and everyone else with Dropbox International Unlimited Company in Ireland. The terms are governed by California law unless your country’s law requires otherwise, and Dropbox’s production systems run in data centers in the United States. Dropbox, Inc. is listed on Nasdaq. It publishes a transparency report on government requests twice a year, most recently for July to December 2025, and says US law does not let it state the exact number of national security requests it receives. Because Dropbox holds the keys, a valid order can reach the contents of your files.

Security incidents

Dropbox has a long data breach record. In June 2011 a code update broke the login check for about four hours, and some accounts could be opened without the correct password; Dropbox later said fewer than a hundred accounts were affected and no files were changed. In July 2012 Dropbox reported that passwords stolen from other websites had been used to sign in to a small number of accounts, and that a stolen password had opened an employee’s account holding a document with user email addresses.

In August 2016 Dropbox confirmed that a list of email addresses with hashed and salted passwords, reported at 68 million accounts, was real and came from the 2012 incident. It reset every password not changed since mid-2012 and said it had no sign that accounts had been improperly accessed.

In October 2022 a phishing campaign gave an attacker access to one of Dropbox’s GitHub organizations, and 130 code repositories were copied. They held some developer credentials, mostly API keys, and a few thousand names and email addresses of employees, customers, sales leads and vendors. Dropbox said no account contents, passwords or payment details were reached.

In April 2024 an attacker reached the production environment of Dropbox Sign, the company’s separate e-signature service, and took email addresses, user names, phone numbers, hashed passwords, API keys, OAuth tokens and two-factor authentication data. Dropbox says Sign runs on infrastructure largely separate from its other products, that the incident did not reach them, and that its investigation found no access to signed documents or payment details. The incident concerns Sign accounts, not files stored in Dropbox.

Features & Sync

The desktop sync app runs on Windows, macOS and Linux, with Ubuntu and Fedora supported officially; Dropbox says the Linux app is changing and may need extra libraries. There are mobile apps for Android, iPhone and iPad, and the website at dropbox.com works in modern browsers. A single file can be up to 2 TB, though uploads over 375 GB in a browser may fail. Dropbox Transfer on Plus delivers files of up to 50 GB.

File versioning is short on personal plans. Earlier versions and deleted files can be restored for 30 days on Basic and Plus, 180 days on Standard and 365 days on Advanced. Web-based files such as Google Docs, Paper docs and Office Online files are not covered.

Collaborative editing happens on servers. Google Docs, Sheets and Slides and Microsoft Office files open from Dropbox in those companies’ editors, and Dropbox Paper documents, titles included, are stored and rendered on Dropbox’s own servers. Whoever runs the editor can read the document.

Usability & Platforms

Two-factor authentication is available on every plan, with codes by text message or an authenticator app, security keys, passkeys and backup codes; a backup phone number guards against losing the first one. A forgotten password is reset only on the website, not in the mobile app. The free plan connects at most three computers and phones at a time, and signing in on dropbox.com does not count toward that limit; paid plans have no device limit.

Price & Value

The free plan, Basic, gives 2 GB, and Dropbox may close a free account that has not been used for 12 months after warning you. Plus gives one person 2 TB for $9.99 a month on yearly billing or $11.99 a month. Standard starts at 3 TB for the team and costs $15 per user a month on yearly billing or $18 monthly; it adds 180 days of history and password-protected links. The plans page shows the same price for the first year and for renewals; the terms let Dropbox change the renewal price with at least 30 days’ notice by email.

Dropbox refunds only where the law requires it: users in the European Union can cancel and get their money back within 14 days of buying, upgrading or renewing.

Pros and Cons

Our Rating