An encrypted link is not an email attachment

Links feel convenient for a reason

Email attachments are easy because everyone knows the workflow: attach, send, download, forward, forget.

Encrypted links are easy for a different reason: the recipient does not need to install your app. They open a URL, enter a passphrase, and see what you intended to disclose—often in a browser, on any device.

The risk with ordinary links is that they behave like attachments with better marketing. Once opened, the file can be saved, forwarded, searched, and archived in places you never chose.

An encrypted link in NT² is designed to keep the good part—convenience—while adding boundaries.

Three boundaries that matter

A useful encrypted link should answer three ordinary questions:

The payload is encrypted before it leaves your device. NT² servers, when used for delivery, move ciphertext—not plaintext bank fields, API keys, or document scans.

That matters for contractors, landlords, accountants, and anyone who will never install NT². You are not asking them to join your system. You are asking them to view one sealed package under terms you understand.

A better replacement habit

Imagine you need to send a credential to someone for a weekend deploy. The old path is a Slack paste or an email attachment. The better path is:

1. Put the secret in a structured Credential item in your vault.
2. Share that one item as an encrypted link.
3. Give the recipient the share passphrase through a separate channel—call, in person, or a different chat.
4. Set expiry so the link does not remain useful longer than the moment requires.

The recipient gets what they need. You keep the source record in your vault. The shared copy has a narrower life than "everyone who can search that email thread."

Links are a Share mode, not a shortcut around trust

Encrypted links do not remove judgment. You still choose who receives the passphrase. You still decide whether one item is enough. You still keep your master password out of the handoff entirely.

They do remove one bad default: treating every disclosure like a permanent attachment.

For professional one-time disclosure, read One-time disclosure for your lawyer or accountant. For the sender-side API key habit, see You pasted the API key in Slack. Follow the RSS feed.