I would second the idea of using a hash as the secret file name, however I would also recommend salting the hash with the current unix time. While having a coll

I would second the idea of using a hash as the secret file name, however I would also recommend salting the hash with the current unix time. While having a collision between 2 different strings is extremely unlikely, having 2 users upload files with the same name is going to happen at some point. I would also recommend adding a salt to stop an attacker from being able to guess URLs by hashing common filenames. Though using the time in the hash is likely to prevent this, it's low-cost and probably worth it. So, I would recommend (in PHP): $url = md5( 'my_salt_string' . $time . $file_name ); But as Michael noted above, none of this can ever guarantee you security...