Zero-Knowledge Custody
Custody is the part of zero-knowledge that people mix up with encryption. This page separates the two and walks through setting it up for yourself.
Encryption is not the thing you switch on
Every share, paste and secure-request submission created in the browser is already encrypted before it reaches us, on every plan including Free. The content key is generated in your browser and travels in the link itself, so we store ciphertext and never see the key. Nothing about that is gated. See Client-side encryption for the mechanics.
The consequence is that the link is the key. The browser that created the share keeps a local copy of that key; nothing else does. Open the Shares list on a different computer and there is nothing there to rebuild the link from.
That gap is what zero-knowledge custody closes, and custody is the part that requires a Business or Enterprise plan. It keeps a second copy of each content key, wrapped to an account key of yours that only your passphrase — or a device you have already activated — can open, so your dashboard can rebuild links and we still cannot read anything.
What custody actually adds
| Without custody | With custody |
|---|---|
| A link can be re-copied only in the browser that created the share, which caches the keys of your 500 most recent shares locally. | Any device you have activated can rebuild the link for any share you created after custody was set up. |
| Submissions to a secure request open only in the browser that created the request. Anywhere else the viewer stops at "Access link needed" and you have to paste the request's access link. | Submissions open on any activated device, with no access link to paste. |
| Nobody can rebuild a colleague's link, even inside the same team. | Team content can be wrapped to a team key as well, so access is granted once per member. |
Custody is not retroactive. A share created before you set it up has no wrapped copy of its key, and asking for its link elsewhere gives you "Link unavailable on this device".
Before you set it up
The passphrase is generated for you — you do not choose it — and it is shown exactly once.
It is 24 characters, displayed in six groups of four. The alphabet deliberately leaves out the characters people mistranscribe, so there is no I, L, O, U, 1 or 0 in it. When you type it back, "Dashes, spaces and lower case are all fine."
Setting it up
Zero-knowledge custody lives in Account → Security, in the panel headed Zero-knowledge custody. The badge beside that heading tells you where you stand: Active, Read-only, or Off.
- Choose Set up now, then Generate my passphrase.
- On the screen headed "Save this now — it is shown once", use Copy or Download as file. The continue button stays disabled until you have saved the passphrase and ticked the acknowledgement — that friction is deliberate. Copying counts on its own; downloading does not, because the page cannot see whether you completed the save dialog, so a second box appears reading "I have the downloaded file and can find it again." for you to tick.
- Choose "I have saved it — continue".
The device you set it up on is activated at the same time, so you are not asked to type the passphrase you just saved.
Setting up is once-only. A second attempt is refused with "An encryption key already exists for this account" — changing keys goes through the passphrase controls described below, which state what they cost.
If you hold a seat on a team whose plan includes zero-knowledge, you can set up custody even though the subscription is not yours. The seat carries the entitlement, but only once your membership is confirmed — a pending invitation grants nothing.
Activating each device
Each browser is activated once. In the panel, This device shows either "Activated" or "Not activated"; the Activate button opens "Activate this device", where you enter the passphrase. After that, reading encrypted content in that browser never asks again — the key is cached locally, encrypted under a key the browser will not let any script export.
A wrong passphrase gives "That passphrase did not unlock your encryption key." — we cannot tell you anything more specific, because we cannot check it.
Two things to expect:
- In a private window, or anywhere the browser blocks local storage of that kind, the activation lasts for that session only and the next visit asks again.
- Forget on this device drops the cached key from that browser. It changes nothing on your account and nothing elsewhere.
If you try to copy the link for an encrypted share on a device that is not activated, you get "Activate this device to rebuild the link" rather than a broken link. CredenShare will not hand you a link with the key missing.
Adding a second device
Do this while everything still works. An activated second device is the escape hatch if you ever lose the passphrase, and you cannot create one after the fact.
On the new device, open the unlock dialog and choose "I have another activated device — link from there instead", then Get a linking code. It shows a short code.
On a device that is already activated, go to Account → Security and, in the Add another device card, type the code, then check the device name shown under "Approving:" before choosing Approve. The new device polls every few seconds and picks the key up on its own.
What is happening underneath: the new device generates a throwaway keypair and publishes only its public half. The activated device wraps your account key to that public key, and we relay the result. The private half never leaves the new device, so the ciphertext passing through us is addressed to a key we do not hold.
Replacing your passphrase
There are two paths and they are not equivalent. Which one you get depends entirely on whether the device you are sitting at is activated.
| Lossless | Destructive | |
|---|---|---|
| Control | Generate a new passphrase | "I have lost my passphrase", then "Yes, create a new key" |
| Available when | This device is activated | This device is not activated |
| What changes | Only the passphrase wrapping. Your encryption key itself is unchanged. | A brand-new encryption key. |
| Existing content | All of it keeps opening. | Everything wrapped to the old key is orphaned. |
The lossless path is possible precisely because you can still open the key: it is re-wrapped under a new passphrase and nothing else moves. If you merely want to rotate the passphrase, activate a device first and this costs you nothing.
The destructive path exists for the case where the passphrase is gone and no device is activated. Creating a new key is not recoverable. After it:
- Your dashboard can no longer re-display links for existing shares.
- Submissions already sent to your requests become unreadable.
- Any team keys granted to you need re-granting by an admin.
- If you are a team owner or admin holding a team key, you strand it for the whole team — recovering means resetting that team key, which stops all existing team content from opening.
Links you already sent still work for their recipients in both cases, because their key travels in the link, not in your account.
If you meet "This link can no longer be rebuilt" on a share, that is the signature of a destructive rotation: a wrapped copy of the key exists, but it was made under your previous key.
Either way, the new passphrase is shown once, in a card headed Your new passphrase — save it now. Copy it, tick "I have saved it. CredenShare cannot recover it.", then choose Done.
Revoking a device
The Activated devices list shows each device with its label and when it was last used, and offers Revoke.
Revoking the device you are using also forgets the key on it immediately, so the list never claims something that is not true.
API keys asking for account custody
If you mint an API key that asks for account custody, it appears in the same panel under "API keys waiting for your approval". Granting it means wrapping your account key to that key, which only an activated device can do — so the button reads "Activate this device to approve" until you have activated the one you are on.
Think before granting. That key will be able to decrypt anything you can, from anywhere, until you revoke it. Declining revokes the key outright rather than leaving it half-granted.
If your plan lapses
Nothing locks and nothing is deleted. The badge changes to Read-only and the panel says so:
Your plan no longer includes zero-knowledge custody. Everything you already have still opens — new items simply will not be added to your cross-device dashboard until the plan is restored. Nothing has been deleted.
Concretely, on a lapsed plan:
- Existing wrapped keys keep being served, so activated devices keep rebuilding links.
- You can still link a new device, so a replaced laptop does not cost you access.
- Newly created shares, pastes and requests stop having a copy of their key kept for you.
- Setting up custody for the first time, and replacing your passphrase, are both refused with "Zero-knowledge custody requires a Business or Enterprise plan".
Restoring the plan resumes custody for new items. It does not go back and wrap the items created while the plan was lapsed.
Related: Key concepts for how shares, expiry and view limits work, and Encryption for what is encrypted where. If something here does not match what you see, write to support@credenshare.io.