Ephemeral Secret Sharing (Protected Links)

Transmitting credentials through Slack, Microsoft Teams, WhatsApp, or unencrypted email leaves sensitive passwords permanently recorded in chat histories, backup archives, and corporate search indexes.

Vertueal's Protected Links feature allows you to securely share secrets with anyone—even if they do not have a Vertueal account—using client-side encryption and burn-on-read destruction.

How Protected Links Work

The URL Anchor Fragment Innovation

When Vertueal creates a protected link, it formats the URL as:

https://passwordmanager.vertueal.com/share/550e8400-e29b-41d4-a716-446655440000#a8f2c3d4e5f6...

• The string following the hash mark (#) is the ephemeral decryption key.
• By RFC 3986 internet standards, browsers never transmit URL anchor fragments in HTTP requests to the server.
• The server stores the encrypted payload, but never possesses the decryption key.

Step-by-Step: Creating a Protected Link

1. From an Existing Vault Item

1. Open any credential or secure note in your vault.
2. Click the Share button in the item detail view.
3. Choose your sharing settings:
   • Burn on Read (Single View): When checked, the link self-destructs the moment the recipient opens it.
   • Expiration Horizon: Select from 1 Hour, 24 Hours (Default), or 7 Days.
4. Click Generate Protected Link.
5. Click Copy Secure Link.

2. From the Standalone "Quick Share" Menu

1. Click Protected Links in the sidebar navigation.
2. Click + New Share.
3. Type or paste arbitrary sensitive text (e.g. temporary database credentials or server keys).
4. Set your expiration window and burn-on-read preference.
5. Click Create Link and copy the generated URL.

Recipient Experience

Recipients do not need to install any software or create a Vertueal account:

1. The recipient clicks the secure link in their browser.
2. The page fetches the ciphertext from the server and immediately decrypts it using the #key present in their browser's location bar.
3. If Burn on Read was selected, the server irrevocably deletes the record from the database. If the recipient or an unauthorized interceptor refreshes the page, they receive a 404 Not Found: Link has expired or been consumed.
4. The recipient can click Copy Secret (with automated 10-second clipboard clearing).