[Answered ]-What is safe implementation for sensitive data file file_url in Django

Some security notes first.

This is probably a bad idea. Storing sensitive information in plain files is probably not the correct security approach, especially if you plan to use Django’s media storage backend for doing that. It leaves all files out-in-the-open.

If however you really, really, and I mean really need to do that, you should encrypt the file first before saving in Django.

Again though, if at all possible I would recommend to store sensitive information in db. In your case of storing passwords, you can use Django techniques to store that information relatively-safely such as correctly hashing passwords via pbkdf function (e.g. pbkdf or bcrypt, etc). If users will need to download that information, you can always generate the file on the fly for them for download.

Some suggestions for uploading files.

I usually assign random filenames to the uploaded files. This way at least its more challenging for the users to guess the filenames to download them. Not very security since this relies on security by obfuscation but its better then nothing. If you need a Django field which does that automatically, you can do that by making upload_to a callable (there are also 3rd party libs for doing that such as django-auxilium although for full disclosure Im the author of that lib).

Now that files are stored with random filenames, you probably never want to provide direct download links to the users for download but instead authenticate them first and then use something like X-Accel in nginx or X-Sendfile in Apache to actually serve the file to the user. The idea being that you first authenticate user in Django. Then however instead of Django serving the file, you return a special header which nginx/apache catches which contains a filepath to the file nginx/apache should serve to the user. This way you dont have to waste resources in Django to serve the file however you still get the advantage of being able to authenticate the request. There are a number of 3rd party apps for doing that as well.

Finally to protect users from downloading the media files you can use nginx (and I imagine apache) by restricting certain parts of the media folder:

location /media/protected {
  internal;
  alias /var/www/files;
}

In this case nginx will refuse direct user requests to /media/protected and will only allow to serve those files via X-Accel-Redirect header sent by Django. Then all you have to configure in Django is to store files in that path to make them protected:

models.FileField(upload_to='protected/myfiles')