Secure Password Sharing
Create an encrypted share and send its link and decryption key separately
Password Sharing encrypts sensitive content in your browser before uploading it. New shares need both a link and a decryption key. Core stores the encrypted content and cannot recover a lost key.
Create a share
- Open Password Sharing and start a new share.
- Enter a name and the content; optionally associate a company and contact.
- Choose Temporary or Persistent.
- Select an expiration and access limit.
- Keep the generated decryption key, regenerate it, or enter your own key that meets the form's requirements.
- Create the share and copy the Link and Decryption key from the success dialog.
Expiration choices are 1 Hour, 6 Hours, 24 Hours, 7 Days, and 30 Days. Access limits are 1, 2, 3, 5, or 10 successful views.
Send the link and key separately
Send the link through one channel, such as email, and the key through another, such as a phone call or separate messenger. Anyone with both can read the content. Putting both in the same message gives that message's readers everything they need.
Keep the key securely if the share must remain usable. The share list can copy the link again, but it cannot show the original key.
Choose the sharing mode
| Mode | What happens at expiration or the access limit |
|---|---|
| Temporary | Encrypted content is erased and access ends for everyone. Use this for a credential handoff. |
| Persistent | External access ends, but the share is retained. Authorized staff can reset expiration or access count. The decryption key is still required to read the content. |
Persistent storage keeps the content until you delete it. Choose it only when you need to reopen the access window later.
Open a shared link
The recipient opens the link, enters the decryption key, and selects Show content. Decryption happens in their browser.
A successful decryption counts as a view. An incorrect key does not consume a view. If loading or access confirmation is interrupted, select Try again. Core keeps a short-lived confirmation proof for recovery, without storing the key or decrypted content.
Manage a share
The share list shows its name, company/contact, access count, and expiration. Authorized users can copy a link or delete a share. Persistent shares also have Reset Access Count and Reset Expiration in their menu.
Resetting a persistent share does not change its key. If the key is lost, create a new share from the original content and delete the unusable share.
Encryption and legacy shares
New shares use browser-side AES-256-GCM encryption, with a key derived from the decryption password using PBKDF2-SHA256. The server receives encrypted content and verification data, rather than the decryption key.
Older shares show a Legacy badge and use their original links. Some legacy links contain enough information to decrypt without a separate key. Recreate any legacy share you still need using the current form, then delete the old share.