Your drive is only as safe as the ways into it. A FileNext account can have three doors: an email and password, a Google account, and a Telegram chat with the bot. Most people lock the first one and forget the other two.
One password, used nowhere else
Nearly every account break-in works the same way. A shop or forum you signed up to years ago gets breached, your email and password end up in a list, and someone tries that exact pair on every service they can think of. If the password matches, they're in. No guessing, no hacking, just reuse.
So the single most useful thing you can do is give your cloud drive a password that exists nowhere else. FileNext asks for at least 8 characters, but longer is better, and length matters more than symbols. Four unrelated words you can picture, like "copper bicycle monsoon ledger", are easier to remember and harder to crack than "P@ssw0rd1!".
If remembering unique passwords sounds like work, that's what a password manager is for. The one built into your phone or browser is fine. Let it generate the password, let it fill it in, and you'll never type it again.
Treat your email password the same way. Whoever controls your inbox can reset the password on everything attached to it.
Continue with Google
If you'd rather not manage a password at all, sign in with Continue with Google. There's no FileNext password to reuse, leak or forget, and you get whatever protection you've already set up on your Google account, including 2-Step Verification if you've turned it on.
The flip side is that your Google account is now the key to your drive. If you go this route, it's worth spending two minutes in Google's security checkup: confirm your recovery phone and email are current, turn on 2-Step Verification if it isn't already, and sign out of any device you don't recognize.
Your Telegram account is a key too
This is the door people miss. If your first message to the FileNext bot created your account, that Telegram chat is your account. If you connected the bot to a web account later, the chat is a second way in. Either way, anyone who can open your Telegram can list your videos with /videos, change covers, and upload to your drive.
People are more relaxed about a chat app than about a bank login. Don't be. A few habits close the gap:
- Turn on Two-Step Verification in Telegram (Settings, then Privacy and Security). Without it, anyone who can receive an SMS to your number can sign in to your Telegram from a new phone.
- Check Settings, then Devices, now and then. If a device or location is there that you don't recognize, terminate that session.
- Never share a Telegram login code with anyone, for any reason. Telegram will never ask for it in a chat, and neither will we.
- If you share a phone, or hand an old phone to someone without wiping it, sign out of Telegram first or use /unlink in the bot beforehand.
If you don't want Telegram to be a way into your drive at all, you can disconnect it from the Account page on the web and keep using the drive with your email or Google sign-in. Your files stay where they are.
Spotting a fake "FileNext" message
We never ask for your password by email or in the bot. Not to "verify" your account, not to "restore" storage, not to "confirm" a login. If a message asks for your password, or for a login code, it isn't from us, whatever the sender name says.
Other signs worth a second look:
- The link goes somewhere other than filenext.in. Hover over it on a computer, or press and hold on a phone, and read the actual address before tapping. Lookalike domains with an extra letter or a different ending are the standard trick.
- Urgency. "Your account will be deleted in 24 hours" is designed to make you act before you think. A real account notice doesn't need a countdown.
- A password-reset email you didn't ask for. You can ignore it. The link only matters if you requested it. If you want to be sure your account is fine, open filenext.in yourself and sign in; don't go through the email.
- A Telegram account that looks like the bot but isn't. Open the bot from the link on our Telegram page rather than from a message someone sent you, and check that the chat you're in is the same one you've always used.
When in doubt, forward the message to support@filenext.in and ask.
If you think someone else has access
Move in this order.
- Change your password. If you can still sign in, do it from the Account page. If you can't, use Forgot password on the sign-in page and follow the email. If you sign in with Google, change your Google password and sign out all other devices from Google's security settings.
- Check Telegram. Open Settings, then Devices, and terminate any session you don't recognize. If the Telegram account connected to your drive isn't one you control, hit Disconnect on the Account page.
- Look at Shared. The Shared view in your drive lists every file and folder with a live link. If you see links you didn't create, turn them off. A link that's turned off stops working for everyone at once. It can't undo copies someone has already downloaded, so do this early.
- Check Trash. Anything deleted recently is there and can be restored. Emptying Trash is permanent, so don't empty it until you've looked.
- Email support@filenext.in from your account's email address. Tell us what you saw and roughly when. We can't act on requests about an account from an address that isn't attached to it, so write from the one you signed up with.
Then think about how it happened. If the answer is "I used that password somewhere else", go and change it there too, because that other account is probably the one that leaked.
Deleting your account is permanent
Sometimes the right answer is to close the account. Before you do, know what that means.
Delete account lives at the bottom of the Account page. When you confirm, your files, folders and share links are deleted for good, and the Telegram bot is disconnected from the account. There's no grace period and no "undelete". If there's anything in the drive you still want, download it first; selecting a folder and choosing Download gives you a ZIP of everything inside.
If you have Premium, cancel the subscription in your app store account before deleting. Deleting the account doesn't cancel a store subscription, and once the account is gone there's nothing for the subscription to attach to.
If what you actually want is a clean slate rather than no account, you can get most of the way there without deleting anything: turn off every link in Shared, move what you don't need to Trash, and empty it. The account and your sign-in stay.
For the short version of all this, see the security page and the account section of Help.