Dropbox is a home for all your most valuable files. To keep your files safe, Dropbox is designed with multiple layers of protection, distributed across a scalable, secure infrastructure. These layers of protection include:
- Dropbox files at rest are encrypted using 256-bit Advanced Encryption Standard (AES)
- Dropbox uses Secure Sockets Layer (SSL)/Transport Layer Security (TLS) to protect data in transit between Dropbox apps and our servers
- SSL/TSL creates a secure tunnel protected by 128-bit or higher Advanced Encryption Standard (AES) encryption
- Dropbox applications and infrastructure are regularly tested for security vulnerabilities, and hardened to enhance security and protect against attacks
- Two-step verification is available for an extra layer of security at login
- If you use two-step verification, you can choose to receive security codes by text message or from an authenticator app
- Public files are only viewable by people who have a link to the file(s)
Here's a diagram of how the service works:
Dropbox users can access their files and folders at any time via the desktop, web, and mobile clients, or through applications connected to Dropbox. All of these clients connect to secure servers to provide access to files, allow file sharing with others, and update linked devices when files are added, changed, or deleted. The Dropbox service operates various services that are responsible for handling and processing both metadata and raw block storage.
I'm a security researcher, and I found a vulnerability with Dropbox. How do I report it?
This section is for security researchers only. If you're a Dropbox user and you feel your account has been compromised or hacked, please contact Dropbox support
Our responsible disclosure policy promotes the discovery and reporting of security vulnerabilities. If you're a security researcher, and you think you've found a vulnerability with Dropbox, please follow these steps:
- Report any potential security bugs and vulnerabilities to us on the third party service HackerOne.
- Note: If you're a Dropbox user, and you feel that your account has been compromised or hacked, please do not use the Hacker One service. Instead, please contact Dropbox support.
- Give us reasonable time to respond before making any information about the security issue public.
- Do not access or modify user data without permission of the account owner.
- Act in good faith not to degrade the performance of our services (including denial of service).
Dropbox will not sue you or ask law enforcement to investigate if you comply with these instructions. Dropbox spotlights researchers who contribute to the security of Dropbox by recognizing them on HackerOne.
Encryption and private keys with Dropbox
Dropbox doesn't provide for client-side encryption. Dropbox also doesn't support the creation of your own private keys. However, Dropbox users are free to add their own encryption. There are many third party applications that provide encryption at both the file and container level. Visit our forums for more information.
The security of your data is our highest priority and all files stored on Dropbox servers are encrypted. Learn more about Dropbox security.