Free plan

Download control

Control whether viewers can save a copy of your document.

Download control lets you toggle whether readers can save a copy of your document to their device. When downloads are disabled, readers see your document in the viewer but cannot export or save a local copy. This control is available on every plan, including free tier, and is treated as a safety feature rather than a tier-locked capability.

How download control works

By default, documents allow downloads. When you disable downloads, readers who attempt to save the file receive an HTTP 403 error. The restriction applies only to explicit save requests (initiated by the ?dl=1 query parameter); the reader's browser must still receive the page content in order to display it in the viewer. Owners can always download their own documents, regardless of the setting.

Download control is a per-document binary toggle—it either allows downloads for all viewers or denies them for all viewers (except per-recipient overrides). Use the file settings to enable or disable downloads; changes take effect immediately for all active and future viewers.

If you use link variants to share with multiple recipients, you can override the parent document's download permission for each variant independently. One recipient can be allowed to download while another is prevented from doing so, even though both access the same document through different variant links.

When you create or update a variant, set allowDownload in the variant's settings overrides. The override works in both directions: false blocks downloads for that recipient alone, true allows them even when the parent document has downloads turned off. A variant with no allowDownload override inherits the parent document's setting. This per-recipient control is only available with link variants, which require a Pro plan.

Updating a variant replaces its whole overrides object rather than merging into it, so an update that omits allowDownload drops the override and returns that recipient to the parent document's setting.

Understanding the threat model

Disabling downloads removes the download affordance—the UI control and the HTTP 403 response prevent casual saving. However, readers whose browsers have rendered the page have access to the unencrypted content in their browser memory. Download control is a user-experience deterrent, not digital-rights management. A determined user with browser developer tools could extract the content after viewing it.

The controls that pair with it work differently. Viewer protection adds further deterrents in the same category—friction for the uninvested reader, nothing more. Watermarking is the one that changes the outcome: it stamps each reader's identity and access timestamp onto the pages they view and download, so a copy that escapes can be traced back to the reader it came from.

Expiry and burn interaction

Download settings cannot be modified after a document has expired, or after it has been burned (its view limit reached and its bytes destroyed). Attempts to change the download permission on an already-dead link return HTTP 410 Gone. The same 410 applies on the full settings endpoint and the viewer-mode endpoint.

Expired or burned documents also refuse download requests with HTTP 410, regardless of the download permission setting, because the link itself is no longer valid.