Skip to content
PulsVaultDocs
Get started
PersonalPremiumFamilyTeamBusinessEnterprise

Share an item

Share a single item with another PulsVault user — choose an access level, set an expiry, and understand how the encrypted snapshot stays in sync.

Sharing an item gives one PulsVault user access to a single record — nothing else in the vault. The item is re-encrypted with a fresh one-off key on your device, so the vault's own key is never exposed. Item shares are available on every plan, including Free.

Share an item#

  1. Find the item — use the share icon in the secrets table, or open the item and choose Share next to Edit.
  2. Name the recipient. Usually that is the PulsVault User field — the recipient's account email. If your organization only allows sharing inside itself, you get a Members search instead, and you can pick several colleagues at once; anyone who already has access is left out of it.
  3. Choose an access level — MANAGER, EDITOR, VIEWER, or LIMITED. Everyone you picked gets the same level; change one afterwards from the item's sharing list.
  4. Optionally tick Allow re-sharing, set how long the share should last, and add a message.
  5. Send. Item shares take effect immediately — the recipient sees it under Sharing → Shared with Me → Items with no invitation to accept.
The recipient must have a PulsVault account — and the dialog offers a way round it

Item shares are addressed to a registered account email. If the address you enter has no PulsVault account, the dialog says so and offers Send as a Secure Link instead — one click, carrying the address across so the secure link stays locked to that person and still requires them to verify by email before it opens.

You send that link yourself. PulsVault cannot email it for you: the key that decrypts it lives in the link's #fragment and never reaches our servers, so there is no version of the link we could deliver on your behalf that would actually open.

Sharing a whole vault is different — it needs a registered account and has no link fallback, because a vault share hands the recipient a key wrapped to their account. There is nothing to wrap for someone who does not have one yet.

How it works#

Your device decrypts the item's fields, generates a fresh ephemeral AES key, re-encrypts the fields as a snapshot, and wraps the ephemeral key with the recipient's public key. The server stores only the encrypted snapshot and the wrapped key. Because each share gets its own key, revoking one recipient never affects another — and the vault's DEK stays private.

Keeping shared items up to date#

The recipient holds an encrypted snapshot. When you edit a shared item, PulsVault re-encrypts the new values for every active recipient so they see the latest version. Secure links, by contrast, are frozen at creation and never update.

Manage item shares#

Under Sharing → Manage → Sent you can see every item you've shared, change a recipient's access level, or revoke a share — access ends immediately. Recipients see revoked items disappear from their Shared with Me list.

Limits and rules#

  • Active share limits: 3 on Free, 20 on Premium, unlimited on Family and above.
  • Primary vault items can't be shared — move the item to a secondary vault first.
  • Duplicate shares are rejected — an item can be shared with the same person only once at a time.
  • In organizations, sharing policies apply: recipients outside the organization are blocked unless an admin allows external sharing, and vaults that require approval currently support the approval workflow for vault shares only.
Was this page helpful?