Public share links

Generate a unique URL to a task, wiki page, or saved view. You get optional password protection, expiry, access-count tracking, and a granular scope (read vs comment).

• SHA-256 token hash stored server-side; the raw token is shown only once, on creation
• Scrypt password hashing with a per-row salt
• Revoke or expire anytime; every access bumps the counter

• Revoked shares return 403, not 404, so receivers know the link was deliberately turned off.
• Passwords are stored hashed and cannot be recovered. Regenerate a new share if the password is lost.

1. 1Go to Settings > Public share links > New share.
2. 2Pick the entity, scope, optional password, and expiry.
3. 3Copy the URL. It is shown only at creation time.

I lost a share link. Can I look it up again?

No. Only a hash of the token is stored, and the raw link is shown once at creation. Create a new share and send that instead. This is what stops a leaked database revealing every live share.

Why does a revoked share link return 403 rather than 404?

No, it is deliberate. A revoked share answers 403 so the recipient learns the link was turned off on purpose rather than mistyped. A 404 would leave them retrying an address that will never work.

How do I recover a share password I have forgotten?

You cannot. Passwords are stored hashed with a per-row salt and cannot be read back. Revoke the share and create a new one with a password you record somewhere safe.