Skip to main content
Email verification adds an identity check to a public (People with the link) shared link. When you turn it on, anyone who opens the link must prove their identity by verifying their email address with a one-time passcode (OTP) before they can view or download your content. This ties every access event to a verified email address, so both you and your administrators know exactly who opened the link. You can verify any recipient, or limit access to the email addresses and domains on the link’s Access List. Email verification is available on Business plans and above at no additional cost.

​
When to use email verification

Public shared links are a frictionless way to share content, but once a link is sent, it can be forwarded, leaked, or discovered. Password protection helps, but a password can easily be forwarded along with the link. Email verification closes that gap by tying access to an individual, verified email address. Use email verification when you want assurance about who is accessing content shared through a public link. Use it instead of a password when you need a verifiable record of each recipient. The following table compares the two options:
Email verification and password protection are mutually exclusive. A shared link can use one or the other, but not both. When you turn on One-Time Passcode protection, Password protection turns off automatically, and the other way around.

​
Verification modes

When you require email verification, choose one of two modes:
  • Anyone with an email: Any recipient can access the link after verifying their email address. Use this mode when you’re sharing broadly but still want a record of who accessed the content, without listing recipients in advance.
  • Only people added to the link’s Access List: Only recipients whose email address matches the link’s Access List can access the link. Use this mode when access should be limited to specific people or organizations. You can add individual email addresses, such as user@example.com, and whole domains, such as example.com.
In both modes, people who are already signed in to Box are recognized automatically and are never shown a passcode challenge. This includes collaborators on the file and people using the Box mobile apps or Box Drive. See What recipients experience.

​
Before you begin

  • Your account must be on a Business plan or above.
  • The shared link’s access must be set to People with the link. Email verification isn’t available on People in your company or Invited people only links, because those recipients already sign in to Box.
  • Only owners, co-owners, and editors of the item can add, change, or remove email verification.
  • Email verification doesn’t work on shared links to Box Notes.

​
Requiring email verification on a shared link

  1. In your Box files view, hover over the file or folder and select Share.
  2. At the bottom of the Share window, confirm the link access is set to People with the link. If it’s set to anything else, email verification is unavailable.
  3. Select Link Settings. The Shared Link Settings window opens.
  4. Turn on One-Time Passcode protection. If the link has a password, Password protection turns off.
  5. Under After verification, allow access to, choose a verification mode:
    • Select Anyone with an email to let any recipient access the link after verifying their email address.
    • Select Only people added to the link’s Access List, then select Configure and add the email addresses or domains that can access the link. You can add up to 1,000 entries.
  6. Select Save.
After you save, the Shared Link Settings window shows that one-time passcode protection is on, which mode is selected, and, for the Access List mode, the approved email addresses and domains. You can edit the Access List at any time.
You can add email verification to an existing shared link at any time. The requirement takes effect immediately. Every access attempt after you save must be verified, including attempts from people who already had the link.

​
Editing or removing email verification

Any owner, co-owner, or editor of the item can change the verification mode, update the Access List, or remove the requirement. To do so, reopen Link Settings, make your changes, and select Save. Changes take effect immediately for any later access attempts.
When you turn off One-Time Passcode protection, or turn on Password protection, Box removes the link’s Access List. If you turn email verification on again later, add the entries again.

​
What recipients experience

The experience depends on whether the recipient is signed in to Box:
  • Anonymous recipients (not signed in to Box): Recipients enter their email address, receive a 6-digit code from noreply@box.com, and enter that code to access the content. In the Access List mode, they can access the content only if their verified email address matches the Access List. For the full recipient walkthrough and troubleshooting, see Accessing a shared link that requires email verification.
  • Signed-in Box users and collaborators: Recipients are never shown a passcode. Box checks their identity automatically. In the Anyone with an email mode, they can access the content immediately. In the Access List mode, they can access the content if their email address is on the Access List, and are denied access if it isn’t.
After a recipient verifies an email address, the verification is valid for one hour and applies to any link that the address is authorized for during that time. Recipients aren’t challenged again while moving between your shared links.
On folder links that require email verification, recipients can’t download several items together or download the whole folder. Box displays a success message, but doesn’t create or download the ZIP file. Recipients can download each file individually.

​
Platform support

The following table shows where you can configure and use email verification: Because people using the Box mobile apps and Box Drive are always signed in, they’re never shown a passcode challenge. Box grants or denies access automatically based on their identity.
Last modified on October 22, 2026