Secure delivery

With secure delivery, someone you send secrets to often sets up a passkey once. After that, what you send them can be sealed to that passkey, and anyone else who gets hold of the link can’t open it.

Invite someone

1. In Send a secret, enter their email address.
2. Leave Wait until they’ve set up chosen.
3. Choose Encrypt and hold.

Wait needs your vault open in this browser.

We email them an invitation. The secret waits, encrypted, until they’ve set up. It’s locked to your own key, so only you can send it.

It waits for 14 days from when you held it. If you haven’t sent it by then, it’s deleted and we tell you. Closing its ticket deletes it too. Owners and Admins can cancel it.

Choose Send now instead if it can’t wait. That secret goes the normal way, and they’re invited for next time.

What the recipient does

1. Opens the invitation and asks for a code by email.
2. Types the code and sets up a passkey on their phone or computer.

There’s no recovery phrase to keep. They set up once for each organisation that sends them secrets; their passkey list shows which is which.

Send the waiting secret

We email you when they’ve set up. Open the share and choose Seal and email it (or text it, or show the link, depending on how you chose to deliver it).

Before you do, check with them by phone or in person that they set it up themselves. Anyone who can read their email could have. Don’t check by email.

From then on, Seal to their passkey is on whenever you send them a secret. Their passkey is the gate, so a passphrase or code is optional, even where your policy requires one.

Your own team

Members of your organisation don’t need to set up. Their vault is already protected by their passkey, so a secret you send to a teammate’s work address is sealed to their vault:

• Seal to their vault is on as soon as you type their address. Nobody is invited.
• They open it signed in to SafeHanded, with their passkey. Nobody else can, including you and Owners.
• Their vault is the gate. You can add a passphrase under More protection, but not an emailed code.

If they haven’t set up their key yet, or they’re an Auditor, it goes the normal way. If they started over since, the share page says so: send it again.

Teammates never appear under Shares → Secure delivery.

Who’s set up

Shares → Secure delivery lists everyone you’ve invited, the address they set up on and when you last sealed something to them. Anyone who can send secrets can send a pending invitation again.

Owners and Admins can also:

• Reset someone: their passkey stops working and they get a new invitation.
• Remove someone: their passkey stops working and their secure delivery details are deleted. Secrets sealed to them can’t be opened, and anything waiting for them is discarded. Past shares still show who they were sent to. Anyone who can send secrets can invite them again.

Someone with nothing sealed to them for 12 months is removed automatically, the same way.

Lost passkey

On a sealed secret, the recipient clicks Lost your passkey? and we email them a new set-up link. Their old passkey keeps working until they finish.

Secrets sealed to the old passkey can’t be opened. Their share pages show Send again. The person who invited them, and your Owners and Admins, are told when someone sets up again.

When their key changes

When someone sets up again, New share asks before sealing to their new passkey. It shows the date they set up again and a fingerprint.

Phone them, or ask in person, and check the fingerprint. Don’t check by email. They see it on the set-up page and under every secret they open. If it matches, choose Use their new key. If not, or you can’t check, choose Send the normal way instead. See How keys are checked.

Your own domain

A recipient’s passkey belongs to the web address they set it up on: your client’s page domain, or safehanded.com. Sealed secrets to them always come from that address.

If you stop using that domain, secrets to them go the normal way until they set up again.

Devices that can’t

Secure delivery needs a passkey that supports the WebAuthn PRF extension. Not every device does.

If theirs doesn’t, the set-up page says so and nothing is saved. Secure delivery shows Couldn’t set up, and their secrets keep arriving the normal way.