Receiving a Secure Request
Someone asked you for a credential through CredenShare. This page is for you, the person filling the form in — no account and no prior knowledge assumed.
What the link is
A CredenShare user created a secure request: a short form that collects a specific credential — a password, an API key, a licence key — instead of asking you to send it by email or chat. The link they gave you looks like /r/ followed by a short code: the app builds it as https://crs.sh/r/<code>, and the same page also opens on app.credenshare.io.
Opening it shows the title they gave the request, any instructions they wrote, and one box per item they asked for. Nothing you type is sent until you press Submit Securely.
The reason they used it is that an email or a chat message keeps a copy of your credential in a mailbox, a channel and a backup, indefinitely. This does not.
You do not need an account
Filling in the form is free, requires no sign-up and installs nothing.
There is one exception. The person who created the request can require a CredenShare login, in which case you see Login Required and "You need to be logged in to submit this request." Either register a free account, or ask whoever sent the link to turn that setting off — they can change it on the request they already made, and the link stays the same.
These two settings can also stand between you and the form, and both are normal:
| What you see | What it means |
|---|---|
| Password Required — "Enter the password to access this request form." | The sender set a password on the form. They should have sent it to you separately. |
| Secure Request — "By proceeding, you acknowledge that your access will be logged." | An acknowledgement prompt the sender enabled. They can replace that wording with their own. Press I Understand, Continue; a password gate may follow. |
Before you fill it in
The fields are chosen by whoever created the request, not by CredenShare. We do not vet what a request asks for, so the question to ask is whether you trust the person who sent you the link — and if you are not sure, confirm with them through a channel you already use, not by replying to the message that carried the link.
Two things are worth checking:
- The domain. A genuine link is on
crs.shorapp.credenshare.io. Nothing else is ours. - The branding. The page may carry the sender's own logo and colours — Business and Enterprise accounts can brand the form. Branding is not evidence either way. The domain is.
What happens to what you type
Your answers are encrypted in your browser, before anything is sent.
The form arrives carrying a public key that belongs to this request. When you press Submit Securely, your browser generates a one-time key pair, combines it with the request's public key to derive an AES-256-GCM key unique to your submission, encrypts your answers with it, and sends only the result. You will see "Encrypting and submitting..." while that happens.
The key that decrypts your submission is never sent to us. Because every submission gets its own one-time key pair, one person answering a request can never read another person's answers either.
Who can read your submission
The person who created the request. The key to read submissions lives in a private link they kept for themselves and never sent to us, so we hold ciphertext we cannot open, and nobody who merely has the link you were given can read anything.
One extension to that: if the request belongs to a team whose account uses zero-knowledge custody — a Business and Enterprise feature — the requester's key is also wrapped to the team, so a colleague they have granted access to can open your submission as well. That is a custody arrangement inside their account. It does not give us the key.
Alongside your answers, they see your IP address — or your email address, if you were signed in to a CredenShare account when you submitted. If the request is answered by several people, each submission is listed separately.
When your submission arrives, the requester gets a notification inside the app. They also get an email, unless they turned that setting off when they built the request.
How long it lasts
Two separate clocks apply.
The form. The sender sets an expiry date on the request, and can also cap the number of submissions it accepts. When either is reached the link stops working and shows "This request is no longer available".
Your submission. It is deleted automatically after a lifetime the sender fixed when they built the request — hours up to 24, days up to 31, or months up to 3 — and they also chose whether the countdown starts when you submit or when they first open your submission. Deletion is permanent and irreversible; nobody, including us, can recover it afterwards.
The form shows a panel headed How your submission is protected. Its Auto-scrub line always reads 7 days after submission, which is the default rather than a reading of what this sender set. If the exact lifetime matters to you, ask them.
You cannot edit or withdraw a submission once it is sent. If you entered the wrong value, open the same link again and submit the correct one — unless the request has reached its submission cap — and tell the sender which one is right, because both will be listed.
If the link does not work
Three messages are worth telling apart:
- "This request is no longer available" — the request has expired, hit its submission cap, or been deleted. The same card appears when the link is incomplete, so check first that you opened it whole, exactly as you received it; then ask the sender for a new one.
- "Unable to Load Request" — the form itself could not be loaded. The line under the heading says why; Try Again retries. If it reads "This request requires two-factor authentication. Enable 2FA on your CredenShare account, then refresh this page.", the sender restricted the request to accounts with two-factor authentication switched on.
- "Failed to submit. Please try again." — the form loaded but nothing was stored. If a retry fails too, the cause is on the requester's side, most often that their account has no share allowance left. Tell them; nothing reached them.
If none of those fits, see Link not working.
Still stuck, or unsure whether the request is genuine? Write to support@credenshare.io.
Secure Requests
Collect a credential from somebody else — how to build the form, which of the two links to send, and how to read what comes back.
SecurePaste
The public paste tool at paste.credenshare.io — no account, no plan allowance, a fixed 24-hour expiry and a link that opens once by default. Plus the signed-in version and what it adds.