Skip to content

Shared Notes

Jump to bottom
BobWs edited this page Nov 1, 2026 · 3 revisions

🔗 Shared Notes

Share any note via a secure, token-based link. Recipients do not need a Flatnotes-Enhanced account, and you control exactly what they can do — view only, or view and edit.

This page covers creating, managing, and revoking share links, plus the security behaviour behind them.

Overview

Capability Details
Permission levels Read only, or can edit
Expiry 7, 30, 90 days, or never
Password protection Optional, bcrypt-hashed
Multiple links per note Yes — each note can have several active links
Activity tracking View count and last-accessed time per link
Admin page /shares — lists every active link across all notes
Revocation Individual links, or all links for a note at once

Note

Requires login. Sharing is a feature of the authenticated app. It is not available in Showcase Mode, and share routes are excluded from the PWA cache so revoked links never work offline.

Creating a Share Link

  1. Open any note.
  2. Click the Share button in the toolbar.
  3. In the modal, choose a permission level:
    • Read only — recipient can view the note content but not edit it.
    • Can edit — recipient can view and edit the note content.
  4. Set an optional expiry: 7 days, 30 days, 90 days, or never.
  5. Optionally add a password. This is bcrypt-hashed before storage.
  6. Copy the generated link and send it.

Note

The link is shown once at creation. Store or send it immediately — raw tokens are never persisted, only their SHA-256 hashes.

What a Recipient Sees

Permission Recipient can
Read only View the note content
Can edit View and edit the note content

Recipients do not need an account. They open the link in a browser and, if a password was set, enter it once.

Visual Indicators in the Note View

When a note has at least one active share link:

  • The Share button turns orange and shows the label “Shared”.
  • A Shared: {date} timestamp appears in the note footer. The date uses your configured date format and locale.
  • Clicking the orange Share button reopens the modal, where you can copy, revoke, or create additional links.

The Share Modal

Open the Share modal from the note toolbar. It shows all active links for the current note, including:

  • A token preview (not the full token)
  • Permission level
  • Whether a password is set
  • View count
  • Last-accessed time
  • Expiry date

Actions in the modal:

  • Create a new link (with the same permission/expiry/password options)
  • Copy an existing link
  • Revoke an individual link
  • Revoke all links for the note in one click

Shared Links Admin Page (/shares)

A dedicated page listing every active share link across all notes, grouped by note.

Access: from the navigation bar menu, under Shared Links (between Attachments and Archive). The entry is hidden in Showcase Mode.

What the page shows, per link:

  • Token preview
  • Permission
  • Password indicator
  • View count
  • Last accessed
  • Expiry

Actions:

  • Revoke an individual link
  • Revoke all links for a note
  • Refresh the list

An empty state is shown when no links exist.

Copying Share Links

The Copy link and Copy new link buttons use the browser clipboard API. On plain HTTP (non-secure origins) where navigator.clipboard is unavailable, a fallback is used so the link can still be copied. Success and error toasts are shown in both cases.

Security Behaviour

Shared Notes are designed so that a leaked link is the only exposure.

Measure Behaviour
Token storage Only SHA-256 hashes are stored. Raw tokens are never persisted.
Password protection Optional, bcrypt-hashed per link
Expiry Enforced server-side; expired links are rejected automatically
Caching Share routes are excluded from the service worker cache (NetworkOnly), so revoked links never work from cache
Tokens shown once The full token is visible only at creation time

Important Caveats

  • Share links bypass normal login. Anyone with the URL can access the note, subject to expiry and password.
  • Read-only links can be forwarded. If the link must stay restricted, use a password.
  • Write links allow editing. Only share with people you trust.
  • Password recovery is not possible. The password is bcrypt-hashed; there is no way to read it back. If it is lost, create a new link.
  • Revocation is immediate on the server, but a recipient who already copied the note content elsewhere cannot be prevented from using that copy.

Typical Workflow

1. Draft a note you want to share for review.
2. Click Share → Read only → expiry 7 days → set a password.
3. Copy the link and send it to the reviewer.
4. Reviewer opens the link, enters the password, and reads the note.
5. You see the view count increase in the Share modal.
6. When review is done, open the modal and revoke the link (or let it expire).

Troubleshooting

Link Returns “Not Found”

  • The link may have expired.
  • It may have been revoked.
  • The token may have been copied incompletely (truncated).

Check the note’s Share modal or the /shares page to see whether the link is still active.

Password Not Accepted

  • The password is case-sensitive.
  • It was set when the link was created and cannot be retrieved. If it is lost, revoke the link and create a new one.

Share Button Missing

  • Showcase Mode hides the share UI. See Showcase Mode.
  • The Share button appears only when you have a note open in the note view.

Copy Button Does Nothing

  • On HTTP origins the app falls back to document.execCommand('copy'). If the browser blocks both methods, select the link text and copy manually.
  • The clipboard API requires a secure context (HTTPS or localhost) for the primary path.

See Also

Clone this wiki locally