Secure sharing

What it is

Sometimes you need to show something private to one person: documents for a lawyer, photos for a partner, records for a family member. VaultWell can make a read-only copy of a vault as a single .vwshare file. The person opens it in VaultWell with a share phrase that you send separately. You choose how many times it can be opened, when it expires, and whether they can save items out.

When the opens run out or the time is up, the copy stops opening.

How to share

1. Open the vault, go to settings, then Share this vault.
2. Set the limits: Can be opened (a number of times or unlimited), Expires after (for example a day, a week or a month), and Allow saving items out.
3. Note the share phrase. Send it separately from the file, ideally by telling them in person.
4. Choose Create share file, then Send share file to pass it on.

The person receiving it follows the steps on Open a VaultWell share.

How it works under the hood

A share has its own fresh random key. Items are re-encrypted from your vault's keys into the share key, chunk by chunk, so the other person never learns your vault's key. The share key is locked with Argon2id from the share phrase. When they join, the content is encrypted again into a new vault on their phone with their own path, and the limits are stored with it.

Honest limits

• There is no server. The limits are enforced by the VaultWell app, not by cryptography. Someone determined who has the phrase could still copy what they see, for example with another camera.
• A share is a snapshot. Changes to your vault don't reach them, and you can't revoke a copy once it's delivered.
• Anyone who gets both the file and the phrase can open it. That's why they should travel separately.
• Live shared vaults are not available today.

Questions