Encrypted share links
Last updated: 28 Jun 2026
Mode B—contractors and one-time handoffs.
Who this is for
Senders who need a one-time or time-limited URL for someone who may not be a vault contact—contractors, lawyers, landlords, or cross-org handoffs.
What you need
| Tier | Free for inline links; hosted links with attachments may need cloud sync registration |
| Vault state | Unlocked |
| Network | Inline small payloads can work offline; hosted relay links need network at create and fetch time |
| Feature toggle | None required for basic link share from asset Share sheet |
Steps
Create a link from an asset
- Open the asset → Share → Share link.
- Choose fields (and attachments when offered).
- Set share passphrase—not your master password. Use Generate passphrase or type a strong unique phrase.
- Optional: Link expires after N days, Burn after first view for one-time delivery.
- Copy the URL and passphrase in separate channels.
Link types
| Type | When NT² uses it |
|---|---|
| Inline / inbox link | Small shares—payload encoded in https://se.nt2.me/?m=…; recipient imports to Inbox |
| Hosted relay link | Larger payloads or attachments—ciphertext on relay; requires vault cloud registration |
Recipient flow
- Opens the link (or pastes it at
https://se.nt2.me/receive/link). - Enters share passphrase from the sender.
- Read-only view or Save to vault / Inbox accept depending on wire type.
Revoke (optional)
When Sent shares outbox is enabled, revoke hosted links from Settings → Sharing → Sent shares—see Sharing outbox.
Tips and common mistakes
- Share passphrase ≠ master password—NT² blocks reusing the vault master password when detected.
- Out-of-band passphrase—never put the passphrase in the same message as the URL.
- No passphrase mode means anyone with the full link (including QR) can decrypt—acknowledge the warning for sensitive data.
- Expired, revoked, or already-viewed burn links show clear errors on the public open page.
- For air-gapped transport, prefer Share files (.nt2share) instead.