Secure file sharing with expiring links
Most "secure file sharing" comes down to one question: after you send a file, can you still change your mind? Email says no. Shared drives say yes, but only if the recipient creates an account first.
Capsule keeps the sender in control without putting any burden on the person receiving the document.
Controls you set before sending
Every share is a link with rules attached. You decide the rules when you create it, which is the only moment anyone reliably thinks about them.
- Expiry date — access ends on its own, so nothing stays open indefinitely.
- View limit — cap a link at one or five opens; a leaked link becomes a dead link.
- Password — add a second factor, shared over a different channel than the link.
- Email verification — the recipient proves control of an address before the document opens.
- Instant revocation — kill access at any point, including after it has been opened.
Recipients never create an account
This is a security decision, not a convenience one. Every account you require is a reason for someone to route around your process — forwarding the file to a personal address, or asking you to "just email it instead". Security people avoid is not security.
A Capsule recipient clicks a link and reads the document. That is the whole experience.
A record of who opened what
Each open is recorded with a timestamp, so "did they receive it?" has an answer that does not depend on memory. On email-verified shares, each view is tied to a verified address rather than to a URL that may have been forwarded.
That record survives the link expiring, which matters because disputes usually surface long after the share does.
Optional end-to-end encryption
For the most sensitive material you can encrypt the document in your browser before it is uploaded. The key travels in the part of the link after the # — the fragment, which browsers never send to a server — so we hold ciphertext and cannot read the contents.
It is an option rather than a default, and worth being precise about the trade: with it on, nobody can generate a preview, search the contents, or recover anything if the link is lost. Most documents are better served by the standard mode; some justify giving all of that up.
Common questions
- Do recipients need an account to open a secure link?
- No. Recipients open the link in a browser and read the document. No account, app, or password reset is required, unless you specifically choose to require email verification or a password for that share.
- Can I revoke a file after I have already sent it?
- Yes. Revocation takes effect immediately, including for links that have already been opened. The next attempt to open the link is refused.
- What is the difference between a password and email verification?
- A password is a shared secret you send over a different channel. Email verification asks the recipient to prove control of a specific address before the document opens, which also ties each view to a person rather than to the link itself.
- Is the file encrypted?
- All shares are encrypted in transit and at rest. You can additionally enable end-to-end encryption per share, which encrypts the content in your browser so our servers only ever hold ciphertext.