Share encrypted snapshots

Share values from a vault

Owners and admins can select 1–50 secrets in an environment and choose Share. Review the selection, choose expiry (1–90 days or 1–3 months), and set a reveal limit from 1 to 100. Sharing protected production values requires explicit confirmation. A selection must fit within the 256 KiB share-content limit.

The browser encrypts a snapshot of those values. The full viewing link is shown only when created; copy it then and deliver it through an appropriate private channel. The Secrets → Shares catalog tracks selected key names, expiry, reveals remaining, and Active, Revoked, Expired, or Exhausted state. It cannot recover the complete viewing link.

Changes to source secrets do not change the snapshot. If you need to share a rotated value, create a new link and revoke the old one.

Understand the viewing link

The browser encryption key lives in the URL fragment—the portion after #. The share service stores ciphertext, an IV, a link verifier, expiry, and view count; it does not receive that key as part of the ordinary page request.

The complete link is a credential. Someone with it can reveal the content within its limits. Do not post it publicly, include it in logs, or remove its fragment. Opening the landing page alone does not consume a reveal; the reveal action does.

Expiry and view limits apply to future reveals. They cannot revoke a downloaded file, copied value, screenshot, or recipient's memory.

Revoke a workspace share

Open Secrets → Shares, find the link by ID or key name, and revoke it. Revocation prevents future reveals and clears the stored ciphertext. It does not mutate the vault values. Rotate the real credential if the recipient should no longer have access.

Revoking a link is not a Trash restore workflow: you cannot recover the original fragment key from the catalog or reopen a revoked snapshot there.

Standalone Secrets Share

The separate Secrets Share service can create an encrypted text or named-value bundle without organization membership. Its composer offers shorter expiry choices and optional password protection. A wrong password does not consume a reveal. Send the password through a separate channel from the link.

Standalone shares are not vault membership, live synchronization, or an organization audit log. They are separate from owner/admin-managed vault shares; do not assume every standalone-composer control is available for a vault-created share.

Troubleshooting

If a recipient cannot reveal, check that the full fragment-bearing link was preserved, the link has not expired, its reveal limit remains, and it has not been revoked. For password-protected standalone links, verify the password through a private channel. A lost full link cannot be reconstructed from the share ID—create a new share instead.