Files & attachments
How to attach files to vault items, how client-side encryption protects them, what can be previewed, and the size and count limits.
Most item types accept file attachments — scans of a passport, a PDF contract on a Document item, a PEM file on an SSH key. Attachments follow the same zero-knowledge rule as fields: files are encrypted in your browser before they leave your device (AES-256-GCM with the vault's key, a fresh random IV per file), so the server only ever stores ciphertext.
Upload a file#
- Create or edit an item and find the Attachments panel (shown when the item type supports files).
- Drag files onto the dropzone or click browse. You can select several at once.
- Watch the progress: files are encrypted first, then uploaded.
- When creating a new item, files stay Pending until you save — nothing is uploaded before the item exists, and you can still Remove them.
Files are validated before upload: size, file type, and per-item count are checked locally, and your plan's storage quota is checked before anything is encrypted.
Limits#
| Limit | Value |
|---|---|
| Max size per file | 25 MB |
| Files per item | Set per item type — from 2 (Login, Credit card) up to 10 (Document, Medical record); see Item types |
| Accepted formats | Per item type — typically images (PNG, JPEG, WebP), PDF, text/JSON/PEM, Office documents, ZIP |
| Total storage | Per your plan; upgrade or contact support when the quota is reached |
Audio and video files are not accepted as attachments.
Preview and download#
Attached images appear as a decrypted thumbnail gallery; other files appear as document rows ("size · encrypted"). Click a file to open the full-screen viewer:
- Images and PDFs render inline.
- Text, JSON, and PEM files show a text preview (first 256 KB).
- Other formats (Office documents, ZIP…) show "Preview isn't available for this file type" with a Download button — they're never decrypted just for preview.
Use ←/→ to move between an item's attachments and Esc to close. Every file has a Download & decrypt action that decrypts it on your device and saves the original file.
Previews and downloads decrypt in browser memory only. The decrypted data is discarded as soon as you navigate away or close the viewer, and the vault must be unlocked for any of it to happen — a locked vault shows "Unlock the vault to view attachments."
Delete an attachment#
While editing an item, use the delete action on a file and confirm. Deleting an attachment is permanent and cannot be undone. In read-only views (items shared with view-only access) you can preview and download but not add or delete files.
Related#
- Item types — per-type attachment limits
- Create & manage items
- How encryption works