Decentralized storage distributes the custody or access of files among multiple participants. It can reduce reliance on a single server, but it does not automatically make data private, permanently available or free.
Before choosing a solution, three questions need to be separated: how the file can be found, who keeps a copy and who can read it. IPFS and paid storage networks do not address these questions in the same way.
In brief
- A content identifier can verify a file; it does not guarantee that a copy will remain available.
- Encryption, replication and retrieval must be organized separately.
- A single gateway or provider can recreate a point of dependency within a distributed system.
How does decentralized storage work?
The difference from a conventional service lies in how responsibilities are distributed. Our guide to centralization and decentralization explains how a simple interface can conceal very different dependencies.
In a content-addressed system, an object is located through its content rather than its position on a specific server. The IPFS documentation explains the role of content identifiers, or CIDs, and how to find participants that can provide the data.
This approach helps verify the integrity of what is retrieved. It does not prove the author’s identity, the accuracy of the document or the right to distribute it. A false file can also have a perfectly valid identifier.
IPFS does not promise to retain every file
Sharing a file on IPFS does not mean that every participant will keep a copy. Data can be cached and later removed to free up space. If no one retains the requested object, its identifier alone cannot make it reappear.
The documentation on persistence distinguishes this cache from pinning: explicitly retaining data on one or more nodes to prevent its removal during local cleanup.
A pinning service makes this easier, but it also introduces a commercial commitment. Check what happens if you stop paying, the operator shuts down or your file exceeds the limits of its plan. Several genuinely independent copies are better than a general promise of permanence.
Decentralized does not mean encrypted
The IPFS documentation on privacy states that the protocol does not automatically encrypt published content. Participation and search metadata can also reveal information.
If a file is sensitive, it must be encrypted before distribution, with appropriate key management. Distributing a file across several machines is not, by itself, an encryption method.
A crypto wallet recovery phrase should therefore never be published in plain text on a file network. The fact that the address is difficult to guess is not sufficient protection.
Filecoin and storage commitments
A paid network adds incentives and commitments to data retention. The Filecoin storage market specifications describe agreements between clients and providers, with defined terms.
However, retention and retrieval are different things. Filecoin’s explanation of storage and retrieval deals sets out these two functions. For real-world use, also examine download times, interfaces and costs.
A document archived for a given period is not necessarily accessible at the speed of a local drive. Test retrieval before entrusting a large volume of data, and keep a backup copy suited to your needs.
An NFT does not necessarily contain its image
A token may point to metadata or a file stored elsewhere. This separation is one of the practical challenges facing NFTs: owning the token does not necessarily mean funding the permanent preservation of the associated media.
When a smart contract references an external resource, check who can modify that reference and who maintains the file. A link to a single gateway may stop working even if other copies remain available.
Control must cover the entire chain: the identifier, metadata, retained copies and access methods. The marketing term “on-chain” does not necessarily describe the storage of all the content.
A simple method for choosing a solution
Start by defining the nature of the data: public or confidential, changeable or archived, small or large. Then set your availability requirements, budget and backup responsibilities.
Test access from another device after stopping your own node. Make sure you can retrieve and verify the file, and that you have the decryption keys if necessary. Document the expiration dates and terms of the services you use.
Decentralized storage can improve resilience. That improvement nevertheless depends on concrete copies, keys and operators: the protocol’s name is no substitute for a retention plan.
