G3NOSYSTEMS
MoatKey · Help

Secure Drop

Last updated October 2, 2026

Secure Drop makes a link that opens an item for anyone, even someone without MoatKey. It is encrypted on your device, and the key is only in the link, so MoatKey never sees what you send.

Send an item

  1. Open the item and choose Send with Secure Drop. (You need to be able to edit the Castle. The extension popup doesn't offer it; use the full Castle view.)
  2. Choose Link expires after: 1 hour, 1 day (the default) or 7 days.
  3. Choose Can be opened: once (the default), or up to 10 times.
  4. Optional: Also ask for a passphrase (at least 6 characters). Five wrong tries destroy the link.
  5. Choose Make the link.
  6. Copy the link now with Copy link (Android app or Share the link). MoatKey does not keep it.

Send the link and the passphrase by different routes, for example the link by email and the passphrase by text.

Send just some text

Browser extension Tools → Secure Drop → Send text. Android app Settings → Secure Drop. Text can be up to 10,000 characters.

What is sent

  • Login: username, password, website and notes.
  • Secure note: the note.
  • Wi-Fi: network name, password, security type, whether it's hidden, and notes.
  • Door code: the code and notes.
  • Card: name, number, expiry, security code and notes.

Authenticator setup keys are never sent. Items in the Dungeon cannot be sent with Secure Drop.

How safe is it?

  • The item is encrypted on your device. The key is in the part of the link after #, which browsers never send to a server.
  • One-time use and expiry are enforced by MoatKey's server, not by the encryption. Anyone who gets the link before it is opened can read it. Treat the link like the password itself.
  • The person opening it sees it in their browser, with Show and Copy buttons. MoatKey will never ask for a master password on that page.

See and revoke your links

Browser extension Tools → Secure Drop → Links you sent. Android app Settings → Secure Drop. Choose Revoke on a link that's still waiting. Revoking stops future opens; it can't take back something already opened.

Limits

You can make up to 30 Secure Drops an hour and have up to 50 links waiting at once.