Jotform Uploaded Files Show 404? Check Access Before Asking Clients to Resend

The short answer

First check whether the uploaded file appears in the stored submission for an authorized owner. Then test the exact link that failed in each intended access context. A 404 does not by itself mean the customer never uploaded a file. Nor does an email without an attachment mean the file is missing from the submission. Keep access limited to the people who actually need it while you investigate.

Jotform's error guide describes several reasons for a 404 and separately notes that uploaded-file privacy can cause one. Its file login guide, updated 1 September 2026, says the Require Log-in to View Uploaded Files setting can show a 404 to someone who is signed out. Turning that setting off makes the file available to anyone holding its link; the option cannot be disabled for HIPAA-enabled forms. A permissive link is therefore a change to access policy, not a default repair.

Identify which failure you actually have

Private Jotform Tables sharing has invitations and roles, whereas public sharing exposes table data. Neither a table invitation nor a public table setting proves that a particular direct file link works for that recipient. Never publish a table merely to make a failing file link open.

A proposed three-context check with one synthetic file

Use an innocuous invented image such as demo-square.png, never a client photo. An authorized administrator chooses the desired visibility policy first. Run these checks only in a permitted test form and document each result separately. This protocol has not been run on a Jotform account; the earlier site intake evidence did not include any file upload.

If the owner opens the file while a signed-out visitor cannot, you have demonstrated that difference in this test, not the full cause. If the recipient fails while the owner succeeds, investigate the handoff and permissions. If even the owner cannot locate or open the file in the submission, reconcile the record and field before blaming authentication or asking the customer to resend.

Copy the investigation record

Keep this record in your authorized workspace or on paper. Do not paste private URLs, tokens, invitations or actual customer images into tickets or a public post. Each blank is for an observation or a decision, not a predicted success.

Communicate and escalate without exposing the file

A neutral draft to adapt: "Thanks for sending the file for your estimate. We are checking access to the submission already received. There is no need to send a second copy yet. We will update you by [agreed time] if we need anything further." Send it only if the submission is actually known to exist; otherwise say that the team is checking the submission record.

For support, provide the internal submission reference through an approved private channel, the field name, approximate test-file size, where the link was obtained, the intended access policy, and redacted results for owner, recipient and signed-out contexts with timestamps. State whether the file is present in the stored submission and whether email attachment delivery is a separate symptom. Share a private link or actual file only if support requests it through an authorized channel. An estimator may need a photo without requiring that photo to be publicly accessible.

For broader intake design, see our Jotform field-service intake record, the quote-request forms comparison, and the Jotform review. Those pages serve different decisions; this checklist covers one inaccessible uploaded file.