Sending large files: the practical options compared

A 25 MB mail limit carries about 18 MB of actual file, because Base64 inflates whatever you attach. Above that you need a link, and the free tiers differ enormously: WeTransfer allows 3 GB per transfer but only 3 GB per rolling 30 days and expires it after 3 days, Dropbox Transfer allows 2 GB for 7 days, SwissTransfer allows 50 GB for 15 days. For one big free delivery, use SwissTransfer.

Why 24 MB does not fit a 25 MB limit

MIME Base64, defined in RFC 2045, turns 24-bit input groups into 4 output characters, so "the encoded data are consistently only about 33 percent larger than the unencoded data", and the mandatory 76-character line wrap adds more. Google says its Workspace receiving limits apply "after encoding, which adds about a 37% increase"; Microsoft adds "an additional 33% translation encoding increase" to mail leaving its datacenters. Divide the cap by 1.37: Gmail's 25 MB carries roughly 18 MB of file.

Two more failures announce themselves by code. RFC 1870 (Internet Standard STD 10, November 1995) has servers advertise SIZE on EHLO. A 552 is permanent, "message size exceeds fixed maximium message size" including the RFC's own typo, which is why some bounces arrive in two seconds. A 452 is temporary, "insufficient system storage", which is why the same message goes through an hour later. Every relay enforces its own ceiling, and the message dies at the smallest.

What email allows in 2026

Personal Gmail sends 25 MB. Over that, "Gmail automatically removes the attachment and adds it as a Google Drive link in the email", turning a size problem into a Drive-permission problem. Workspace receives 50 MB on Enterprise Standard and 70 MB on Enterprise Plus, 500 attachments maximum, per documentation updated 2026-07-22.

Microsoft 365 is where the received wisdom is wrong. The famous 150 MB applies only inside Microsoft's datacenters. The documented default is 35 MB sending and 36 MB receiving, admin-configurable from 1 MB to 150 MB, and cross-organization mail tops out at 112 MB. Outlook on the web sends 25% below the configured setting to leave room for encoding, so a 100 MB tenant setting yields 75 MB. Outlook for iOS and Android caps messages at 33 MB, classic OWA attachments stop at 112 MB while OneDrive file attachments reach 2 GB, and on-premises Exchange Server still defaults to 10 MB.

As an email substitute, Telegram allows files up to 2 GB each, or 4 GB with Premium, and WhatsApp raised its ceiling to 2 GB per file from 100 MB. Send video as a document, not through the photo picker, if you want the original bytes to arrive.

The options side by side

Two traps. WeTransfer's free tier is quota-limited two ways at once, "up to 10 transfers (or 3 GB total) in any 30-day rolling window", so a single 3 GB send exhausts the month; Starter raises the total to 300 GB, Ultimate to "unlimited transfers up to 1 TB per transfer". Availability is "calculated from the exact moment the transfer is sent", not from first download, so a recipient who opens your mail on day four gets nothing. SwissTransfer will not zip archives over 10 GB, so recipients download file by file.

Cloud drive links, and the limits nobody reads

Dropbox takes files up to "2 TB (2,199,019,061,248 bytes)", but warns that browser uploads "larger than 375 GB ... may cause timeouts or interrupted uploads", so use the desktop app or the API. Google Drive takes 5 TB per file, then applies the cap nobody expects: "Google Workspace users can only upload 750 GB per day between My Drive and all shared drives", and "You cannot request an increase on this daily threshold limit." It is a rolling 24-hour lockout, not a midnight reset. OneDrive and SharePoint allow 250 GB per file, but the decoded path including filename cannot exceed 400 characters, and that, not size, is the usual cause of "some files didn't sync".

For a single very large delivery, pay per gigabyte. MASV is $0.25 per GB pay-as-you-go, 15 GB free monthly, 5 days of free storage then $0.07 per GB per month. Backblaze B2 is $6.95 per TB per month, with free egress up to three times average monthly storage and $0.01 per GB beyond. Sending 200 GB once is about $50 on MASV against roughly $2 of B2 egress, so use B2 with a presigned URL unless the recipient needs a polished download page.

Self-hosting, and the four defaults that break it

A self-hosted tool advertising unlimited size fails at 1 MB out of the box. nginx client_max_body_size defaults to 1m and returns 413, and nginx's own docs warn "browsers cannot correctly display this error", so the user sees a blank page. PHP ships upload_max_filesize 2M, post_max_size 8M, max_file_uploads 20 and memory_limit 128M. Then the one that catches everyone: Cloudflare caps request bodies at 100 MB on Free and Pro, 200 MB on Business and 500 MB on Enterprise, before your server sees the request. RFC 9110 renamed 413 from "Payload Too Large" to "Content Too Large".

Nextcloud's hard ceiling is "< 2GB on 32Bit OS-architecture", and its docs warn that upload_max_filesize and post_max_size "may not apply" to WebDAV PUT or chunked uploads, where PHP and webserver timeouts dominate. The sync client chunks at files.chunked_upload.max_size, default 104857600 (100 MiB), which is why it works when browser uploads fail.

As a Firefox Send replacement, use timvisee/Send, a fork of the project Mozilla killed in September 2020. It encrypts in the browser with "128-bit AES-GCM encryption via the Web Crypto API", derives file, metadata and HMAC-SHA-256 signing keys with HKDF SHA-256, and appends the secret key to the URL "as a #fragment", which browsers never transmit. So the link is the key: paste it into anything that expands link previews and the file is leaked. Pingvin Share, still widely recommended, "has been archived since Jun 29, 2025"; the maintained fork is Pingvin Share X. Nor is resumable upload standardized: draft-ietf-httpbis-resumable-upload-12 of 6 July 2026 is still an Internet-Draft, and tus 1.0.x runs in production.

Peer to peer, no service in the middle

For two machines you control, magic-wormhole is cleanest: SPAKE2 password-authenticated key exchange, nacl/libsodium secretbox for bulk data, and a spoken code such as 7-crossover-clockwork. The default is "a 16-bit code", so the docs put an attacker at "a 1-in-65536 chance of success" per use, because a code survives one guess. Raise --code-length for sensitive material. croc does the same with a friendlier CLI, claiming "end-to-end encryption (using PAKE)", resumable transfers and no port forwarding.

For two devices in one room, LocalSend beats any cloud service: no internet connection and no third-party server, just a REST API where "all data is sent securely over HTTPS, and the TLS/SSL certificate is generated on the fly on each device". Device identity therefore rests on picking the right name in the list, not on a certificate authority. FilePizza is the misunderstood one: strictly synchronous, because "this requires that the uploader leave their browser window open until the transfer is complete", and behind symmetric NAT the traffic goes through a TURN relay anyway.

Encryption: three claims, one meaning

In transit protects the wire while the provider still sees plaintext at the endpoint. At rest protects against disk theft while the provider holds the keys. End-to-end means encryption on your device with a key the provider never has. Marketing sells the first two as the third. WeTransfer's Trust Center lists ISO/IEC 27001:2022, CCPA, GDPR and PCI DSS v4.0.1 and makes no end-to-end claim, which is a defensible posture; it does mean WeTransfer could read your file, and could be compelled to produce it.

Proton Drive does the real thing: "We do not impose any size limits on your uploads", password-protected links, expiration dates, AES-256-GCM under OpenPGP, all keys generated client-side. On 4 June 2026 it moved to "v6 PKESK and a v2 SEIPD", claiming up to 4x faster uploads, with a 4 MB mobile upload going from 97 ms to 32 ms. Storage runs from the free 5 GB through Drive Plus at 200 GB to Drive Professional at 1 TB per user. Filen, in Germany, is the other zero-knowledge option and prices in binary units: 200 GiB for EUR 1.99 a month, 2 TiB for EUR 8.99. "Plans stack on a single account", Filen says, "with no upper limit."

Better still, encrypt before sending. The .7z format uses AES-256 by default, and -mhe=on encrypts the headers so the file list is hidden too. A password-protected .zip cannot do that, because ZIP stores file names in the clear and leaks your whole directory structure. rclone's crypt remote wraps any of its storage backends with client-side encryption, with --transfers defaulting to 4.

Two footnotes

Free services change their terms under you. Bending Spoons announced its WeTransfer acquisition in July 2024, and the free tier lost its old 2 GB, 7-day shape afterwards. A clause due to take effect on 8 August 2025 licensed user content for "improving machine learning models that enhance content moderation", and was rewritten on 15 July 2025 after objections. Check current terms before promising a client that no third party processes their files.

If a 6 GB file will not copy to a USB stick, the stick is almost certainly FAT32, whose 4 GB per-file limit has not changed. Windows 11 Insider Preview Build 26300 in April 2026 raised only the FAT32 format volume limit, from 32 GB to 2 TB. Reformat as exFAT, which "uses 64 bits to describe file size" under specification revision 1.00.