Share a vault
Invite people to a vault, choose their access level, manage and revoke members, and understand how zero-knowledge sharing re-wraps the vault key.
Sharing a vault gives someone access to every item in it at the access level you choose. The vault's key is re-wrapped for the recipient so sharing stays zero-knowledge.
Share a vault#
- Open the vault and go to Sharing & members (or use the Sharing Center).
- Choose Invite and enter the recipient's email.
- Pick an access level — VIEWER, EDITOR, or MANAGER (OWNER is never assignable).
- Optionally set an expiry date, a message, and whether re-sharing is allowed.
- Send. The recipient gets a pending invitation to accept.
Your primary vault is private by design. Create a separate vault for anything you intend to share.
What happens under the hood#
When you invite someone, PulsVault re-wraps the vault's Data Encryption Key for the recipient's public key on your device. The server stores only the re-wrapped key — it never sees the DEK in plaintext. The recipient unwraps it with their own keys when they accept. See Vault sharing & DEK re-wrapping.
Manage members#
From Sharing & members you can:
- Change a member's access level
- Resend or revoke a pending invitation
- Remove a member — they lose access immediately
Removing a member stops new access right away. Because the member may have seen secrets while they had access, rotate sensitive passwords and, for high-value vaults, perform a DEK rotation (re-encrypts the vault key for remaining members). DEK rotation is client-side.
Organization controls#
In teams and businesses, sharing can require approval and is bounded by shared-vault policies. External sharing may be disabled by an admin.
Related#
- Share an item — share a single record instead
- Secure links — share without an account
- Invitations & approvals