Built by Flowdesk — ex‑FlowCrypt (iOS + Chrome Ext.). Privacy apps, E2EE systems, native & mobile.See workcontact@flowdesk.tech
Flowvault

Use case

Send a password without leaving it in chat history.

Slack, email, and ticket comments are bad places for credentials. Flowvault Encrypted Send gives you a one-time encrypted link with a view cap, expiry window, and optional password gate.

Create a secure send Compare to Privnote
The server stores ciphertext, not plaintext.
The decryption key travels in the URL fragment.
After the final view, the note is hard-deleted.

30-second proof

Feel plausible deniability before you trust the claim.

Open the same demo vault twice: first with CorrectPassword, then lock and unlock with DecoyPassword. Same URL, same ciphertext on the server, two completely different notebooks.

Open the demo Read the hidden-volume deep dive

A safer handoff for credentials

Paste the credential, choose one view and a short expiry, copy the link, then send it through the channel you already use. If the link itself might be logged or forwarded, add a password and share that password through a separate channel.

What the recipient sees

The recipient gets a click-gated page that explains opening consumes a view. That prevents preview bots and accidental page loads from silently burning the note before a human is ready.

Use a vault when the secret needs to live

Encrypted Send is disposable by design. For secrets you need to keep, rotate, back up, or protect behind a decoy, create a regular Flowvault notebook instead and export a .fvault backup.

Good defaults

For most passwords and API keys, use one view and a one-hour or one-day expiry. Use longer windows only when the recipient is in a different timezone or unlikely to open the link soon.

Password handoff checklist

  1. 1Paste only the credential, not extra context.
  2. 2Use one view for passwords and production API keys.
  3. 3Pick a short expiry whenever possible.
  4. 4Add a password if the link travels through email or a ticket system.
  5. 5Ask the recipient to confirm receipt, then rotate if policy requires it.

Trust signals worth checking

Flowvault is MIT-licensed and open end-to-end: frontend, Cloud Functions, Firestore rules, and crypto code are public. The server stores opaque ciphertext; your password and plaintext stay in the browser.

Read the security pageView source See honest limitations