Encrypted attachments

Both requests and shares can carry small files — certificates, recovery-key files, screenshots, config exports — encrypted in the browser with the same content key as the text fields.

How it works

Files are encrypted in the browser before upload, exactly like the credential fields. The server stores them as opaque blobs.
The limit is 10 MB per request or share.
Because they’re encrypted end to end, no server-side scanning is possible — this is stated in the UI, and it’s a deliberate consequence of the zero-knowledge design.

Sending files

On a request — tick Allow encrypted attachments (under Advanced & optional) when creating it; the subject can add files alongside the credential on the handoff page.
On a share — attach files when you Send a secret; the recipient downloads them after passing any passphrase or code.

Good practice

Keep attachments to what the job needs — they’re ephemeral and purged with the record.
For anything sensitive in a share, set a passphrase so the file isn’t readable from the link alone.