Guides

Creating a Share

Every option in the app's Create Secure Share dialog — what each one does, what the recipient sees, and which plan it needs.

The homepage widget takes one secret and fixes every setting for you. Creating a share inside the app gives you the full dialog, and this page documents every control in it.

Open it from Shares in the sidebar and click Create Share. The dialog is headed Create Secure Share, and a badge in its top-right corner shows whether the share will be created in Personal or in a team — switch context before you open it if that badge is wrong.

Title and description

Field	Notes
Title	Required, up to 255 characters. Leaving it empty gives `Title is required`.
Description	Optional, one line.

Titles and descriptions are not encrypted. They have to be readable so your Shares list can display and search them, so they reach our servers as plain text. The dialog says so under the field: Visible to CredenShare — keep secrets in the fields below. Everything you type into the fields below the title is encrypted in your browser. The title is not.

The credential itself is a list of key/value fields. A new share starts with two: Email (text) and Password (password).

Each row has a type picker:

Type	Behaviour
Text	Plain single-line value, shown as typed.
Password	Masked in the editor and for the recipient, with a reveal control.
Date	Single-line date value.
Multiline	Expands into a multi-line editor.
Markdown	Multi-line editor. The recipient sees the markdown source in a read-only block with markdown syntax highlighting, not rendered formatted text.
Source Code	Multi-line editor with syntax highlighting; choose the language from a list of 46, defaulting to JavaScript. The choice styles the editor in the dialog only — it is not sent with the share, so the recipient gets line numbers without language highlighting.

Rows can be dragged by the grip handle on the left to reorder them, and recipients see them in the order you leave them. Import accepts either a JSON object or CSV with one key,value pair per line, and replaces the current field list. On a JSON import, keys containing password or secret become password fields; on a CSV import, only keys containing password do.

At least one field must have a value, or the dialog answers At least one field must have a value.

How many fields you get

Add Field stops at the plan's cap, and the button's tooltip then reads Your plan allows up to N fields per share.

Plan	Fields per share
Free	2
Solo	2
Basic	3
Plus	5
Business	Unlimited
Enterprise	Unlimited

Free and Solo start at the cap, because the two default rows already use it.

Credit-card detection

If any field value looks like a payment card number, the dialog raises Possible credit-card number detected — naming the card network when it can tell — and suggests splitting the number across two shares sent by different channels, adding a password, and lowering the view limit. Saving is blocked until you tick I understand the risks of sharing financial information and want to proceed.

Field templates

Business and Enterprise. If saved share templates exist in your current context, a Template strip appears above the title, offering Apply a template (optional)…. Picking one fills in the fields and whichever settings that template prescribes; the ✕ button beside the picker puts the form back to its two default rows. The strip is hidden entirely when the plan has no template access, or when no share template exists.

Timing

Expiration

Quick Set offers 1h, 24h, 3d, 7d, 14d and 30d. Below it, Unit (Hours, Days, Months) and a slider set any value by hand: up to 24 hours, up to 31 days, or up to 3 months. The default is 24 hours, and the line under the slider confirms it — Expires in 24 hours.

When a share expires the credential is deleted and the recipient gets the expired page. Expiry gives nothing back: an expired share still counts against your allowance.

Expire from

Setting	Behaviour
Creation (default)	The countdown starts the moment the share is created.
First View	Nothing counts down until the content is first requested. At that moment the server converts the window into a fixed deadline. Use it when you cannot predict when the recipient will get to the link.

A First View share that nobody opens does not expire on its own. Note that the clock starts on the first request for the content, which happens before the passcode is checked — a recipient who opens the link and then mistypes the password has already started it.

Viewing times

Unlimited is the default: the share lasts until its expiry. Switching to Limited reveals a slider from 1 to 10, defaulting to 3.

Each successful open consumes one view, and the share is destroyed once the last one is used; later visitors get the expired page. A refused open does not consume a view — a blocked IP address, a wrong passcode and a missing login are all checked before the counter moves.

Timed View

Off by default. When enabled, a slider from 15 to 180 seconds (default 60) controls how long the credential stays on screen after it unlocks. The recipient sees a bar counting down — Content will be hidden in 0:47 — which turns red for the last ten seconds, then reads Time expired as the content is hidden again.

It limits how long a secret sits on an unattended screen. It is independent of Expire from → First View, which governs the share's lifetime rather than one viewing.

Security

Encryption

There is nothing to configure, on any plan. Every share is encrypted in your browser with AES-256-GCM before anything is sent, and the key travels in the link itself, never to us. The dialog states this instead of offering a choice: End-to-end encrypted. AES-256-GCM in your browser; the key stays in the link.

The consequence is worth repeating: a lost link cannot be recovered by anyone, including us. See Key concepts.

Password protection

Solo and above. On plans without it the checkbox is disabled and carries a plan badge, and the API refuses a passworded create outright.

Tick Password protection and type a passcode of up to 100 characters; a strength bar rates it as you type. Until you do, the Security section shows an amber banner reading Secure by default, but anyone with the link can view. Once a passcode is set it turns green: This share is now highly secure.

The recipient meets a Password Required dialog — This share is password-protected — with a passcode box and an Unlock button. Nothing decrypts until the passcode matches.

Send the passcode over a different channel from the link. Two factors delivered down one channel are one factor.

Failed attempts tolerance

Solo and above, and only offered once Password protection is ticked. Off by default; enabling it reveals a slider from 1 to 10 attempts, defaulting to 5. The line beneath reads Delete after 5 wrong attempts.

Every wrong passcode decrements the counter, and the password dialog tells the recipient what is left — 3 attempts remaining.

When the last attempt is spent the share is destroyed immediately and permanently. The content is gone, not locked out. The recipient sees Too many incorrect password attempts. For your security, this share has been permanently destroyed. — and there is no unlock, no cooldown and no recovery. Neither of you is warned or notified. You will find out only by looking at the share yourself. A recipient who fumbles a long passcode five times has cost you the credential, so if the passcode is awkward to type, raise the tolerance or leave this off.

Failed attempts are recorded in the share's access history, so a share that vanishes this way still leaves a trail of the attempts that killed it, within your plan's retention window.

Secure view prompt

Solo and above. A custom message shown on a confirmation gate before the content unlocks — compliance wording, a reminder to find a private location, or context about what is inside. Markdown is supported, and a live counter tracks the 500-character limit; going over refuses the save with a Secure view prompt too long notice reading Secure view prompt must be 500 characters or fewer (Gitea #57).

The recipient sees a card headed Secure Content carrying your message, and must click I Understand, Show Content to continue. With the option enabled but no message written, the default text is This content is view-protected. By proceeding, you acknowledge that your access will be logged.

Access Control

Control	What it does	What the recipient sees	Plan
Require Login	The viewer must be signed in to a CredenShare account, so each view is attributed to a user rather than only an IP address.	A Login Required card: `You need to be logged in to view this share. Please log in to continue.` with a Log In to Continue button that brings them back to the link.	All plans
Require MFA	The viewer's own CredenShare account must have two-factor authentication enabled. Selectable only with Require Login on — unchecking login clears it, and the label reads `(needs Require Login)`.	A Two-Factor Authentication Required card offering Enable 2FA and a retry. Someone already enrolled is told to sign out and back in so the requirement can be re-checked.	All plans
Only Owner Can Delete	Off by default. Left off, the recipient can destroy the share themselves once they have stored the credential; tick it so that only you can.	With it off, a red Delete the Secure Share Forever button under the content. With it on, no such button.	All plans
IP Whitelist	Restricts viewing to the addresses you list. Type an address and press Enter or click Add; entries appear as removable chips. Single addresses and CIDR ranges both work. An empty list means no IP gating.	An address outside the list is refused with `You don't have permission to access this share`. The check runs before the passcode and before any counter, so a blocked attempt costs neither a view nor an attempt.	Business and Enterprise

The recipient meets these gates in a fixed order: login, then MFA, then the secure view prompt, then the password.

Preview, then create

Preview at the bottom of the dialog opens a Recipient Preview — your fields rendered the way the recipient will see them, without creating anything. Create Secure Share commits.

The confirmation screen shows a QR code, the share link with a Copy button, and — if you set one — the passcode behind a reveal toggle with its own Copy button. A copied passcode is wiped from the clipboard after 30 seconds. Create Another clears the form and keeps you in the dialog.

Copy the link before you close the dialog. It carries the decryption key, and our servers cannot rebuild it — that key never reached them. The browser you created the share in keeps its own copy of the key, so the copy-link and QR buttons in the Shares list still work there; that is local convenience, not custody. Clear the browser's storage, use another browser or use another device and it is gone. Only an account enrolled in zero-knowledge custody, on Business or Enterprise, can rebuild its links on its other devices. Otherwise, once the link is lost the share is unreadable for good.

Closing the dialog discards everything you typed; a half-filled form is never restored on the next open.

There is no email, no push notification and no in-app alert when a recipient views a share. Two ways to find out:

Access History — open a share from the Shares list to see every access attempt with its timestamp, IP address, platform, user agent and whether a password attempt failed. It exports as CSV or JSON. How far back you can read depends on your plan: Solo 3 days, Basic 7, Plus 30, Business 90, Enterprise 180. Free accounts have no retention window.
Webhooks — share.viewed fires to your endpoint on every successful open, alongside share.access_denied, share.expired and share.deleted. Requires Business or Enterprise; see Webhook events.

Creating a share spends one of your plan's allowance: Free 3 per day, Solo 50, Basic 100, Plus 200 and Business 500 per billing month, Enterprise unlimited. Expired and deleted shares still count, so removing one frees nothing. The full rules are in Share allowance.

Enterprise Setup

Administering a CredenShare team — moved to the Teams section.

Zero-Knowledge Custody

How the account passphrase, per-device activation and device linking let you reach your own encrypted shares from a second device — and what each way of replacing a key costs you.