Send and receive
confidential data securely.

SchlüsselBot is a German service for securely sending and receiving passwords, login details and confidential files. Content is encrypted in the sender’s browser and stored on the separate vault server only as ciphertext. Whether the key also remains technically outside SchlüsselBot depends on the selected delivery or secure-inbox mode. The message deletes itself after it is read. Neither sender nor recipient needs software or an account for direct sending. People submitting content through a secure-inbox link need no account either; registration is required only to create and manage your own secure inboxes, contacts or teams.

Encryption happens in the browser (AES-256-GCM). In the sending method Secure, the key never reaches us technically — reading it is impossible, not just promised. In the "Simple" sending method, it briefly passes through the server so SchlüsselBot can deliver the final link; it is not logged. For secure inboxes with code or passkey, the key fragment for direct live retrieval is additionally encrypted and temporarily stored on the edge server, then removed after retrieval, expiry or hiding. Only in the secure inbox with your own E2E passphrase does the key never reach SchlüsselBot. Through the Business API, plaintext can be passed; in that case, SchlüsselBot encrypts server-side. For a technically blind API path, the application must encrypt itself and distribute the key independently.

No. The recipient opens the link in the browser, requests a one-time code to their email address, enters it, and reads the message. No account, no app, no installation — not even on a mobile phone.

After the first read, it's gone immediately. If not retrieved, an automated process deletes it after 48 hours. In the Pro and Business plans, you can shorten the retention period to 24 hours or extend it up to 7 days when sending — we do not retain anything longer by default. Attachments are delivered immediately upon opening and remain in the browser — please save them right away, as they disappear when the page is closed. We delete them from the server at the latest 10 minutes after opening — after that, they are permanently gone.

The free plan allows 10 messages per day with attachments up to 2 MB — usable without an account. An optional free account adds an encrypted address book, passkey, and two-factor protection. Pro costs €4.90 per month and includes 50 MB attachments, 200 messages per day, configurable expiry up to 7 days, and personal receiving secure inboxes with five protection levels. Business starts at €19 per month per user, increases the file limit to 100 MB, and adds shared secure inboxes for the whole team or selected individuals, team administration, AVV, §203 obligations, plus API and webhooks. EU companies with verified VAT ID pay the net price via reverse charge. For billing addresses outside the EU, SchlüsselBot currently issues a custom quote after review; self-booking will only be available after technical approval for the respective country. All prices are final, inclusive of 19% VAT for Germany and EU private customers. Cancellations can be made at any time, effective at the end of the paid period.

2 MB per message in the free plan, 50 MB with Pro, and 100 MB with Business. Multiple files can be combined into one message; they are encrypted together.

A fixed link such as schluesselbot.de/i/1234567/mandanten, which you can embed on your website, in your email signature, or in a meeting confirmation. Anyone who opens it can send you encrypted messages and files — without account and without software. This is ideal for handling document submissions in tax advisory firms, law practices, and medical practices. The inbox is part of Pro and Business. New submissions appear live in the account inbox and can be opened directly there; no notification email is required for this. Submissions are available by default for 48 hours in Pro and 7 days for new Business secure inboxes; you can set the availability period for each inbox to 24, 48, 72 hours, or 7 days. You configure the desired Receiving capacity for each inbox yourself in your account. Important for law firms and medical practices: If SchlüsselBot processes personal data on your behalf, a data processing agreement under Art. 28 GDPR is required on a regular basis; additionally, § 203 para. 4 StGB may apply in cases involving professional secrecy. Business provides both documents; Pro does not.

When creating a secure inbox, choose the protection level that fits: One-time code by email, the existing Account passkey only, code plus passkey, code plus a second factor, or your own passphrase with true end-to-end encryption. If a user cannot use passkeys, the code and passphrase options remain available. Nobody can reset a forgotten end-to-end passphrase.

Yes, in the Business plan. An inbox can be shared with the entire team or only with selected individuals; personal inboxes remain private. Each person logs in using their own account and their own security factor. The first person to successfully confirm a submission takes over and opens it. If a team member is paused or removed, access to shared inboxes ends immediately.

A place is a person from your company with their own access — including the team administrator. External senders such as clients, patients, applicants, or others do not need a place or an account. When a team member is removed from the company, their Business license and team access end immediately; their personal account continues as a Free account.

Yes. The group admin can change a running PayPal subscription in the account. After confirmation via PayPal, additional seats become available immediately; the new recurring price applies from the next regular billing cycle, with no prorated adjustment for the current period. A reduction is scheduled for the next billing period and displayed with date and new price. The next charge will reflect the lower amount accordingly. Reduction is not possible under paid seats and pending invitations.

Names and email addresses are stored in the database using AES-256-GCM encryption and are decrypted only for a successfully authenticated session or an explicitly authorised Business API key. Stealing the database alone would therefore not expose the address book in plaintext or reveal matching contacts across different accounts. The encrypted address book, passkey login and optional two-factor protection are available with every account plan.

Yes, with the Business plan. The API can send messages, check their status, withdraw pending messages and manage the encrypted address book. Each key receives only the permissions it needs; approved HTTPS origins also support external browser applications. Signed webhooks report creation, retrieval, withdrawal, expiry and failed email delivery, with automatic retries after errors. API keys and webhook secrets are shown in full only once. Each account can have up to 10 active API keys and 5 webhooks. The public documentation and an OpenAPI file explain every endpoint.

Yes. SchlüsselBot is designed for GDPR-compliant use: the production servers are located in Germany, the interface and encrypted content are separated, and messages are processed with minimal data and retained only briefly. Where SchlüsselBot acts as a processor, the Business plan lets you generate the data processing agreement under Article 28 GDPR directly in your account; an additional Section 203 confidentiality undertaking is available for regulated professionals. SchlüsselBot is one technical and organisational component — your organisation remains responsible for purpose, legal basis, transparency duties and permissions.

Because the password is almost always sent in the same email or the next one — so it ends up in the same email inbox, the same backup and with every provider that handled the message. A ZIP password also does not prevent unlimited copies of the file. With SchlüsselBot, the content can be read only once and then deletes itself.

Yes. When sending, enter your own email address under "Delivery confirmation" — you will then receive a message with the date and time of retrieval. The confirmation contains no message content.

No. The secure inbox uses exactly the passkey that already belongs to your SchlüsselBot account. If you add another passkey as a backup, it can also be used for confirmation after login.