43:["$","title",null,{"children":"One-time download links: where expiry ends | seal | Observable"}] 4b:Te8a,

SEAL Team · 30 October 2026 · An affiliated educational example

A one-time download link limits a future fetch through that link. Expiry sets a time limit on hosted access. Once someone has downloaded and decrypted a file, their copy is under their control. Use this small experiment to see these states separately.

This is an original browser teaching model. It uses a fixed synthetic text and standard AES-GCM from Web Crypto. It does not connect to SEAL, upload a file, test a provider’s implementation, or prove a security property of a service.

4c:T1e2d,// Original local teaching model. This module never calls SEAL or any network API. const sampleText = 'SYNTHETIC CLIENT REPORT\nApproved summary: 12 example items reviewed.\nNo client data.\n'; class HandoffModel { constructor() { this.reset(); } reset() { this.created = false; this.singleUse = false; this.clock = 0; this.expiry = 30; this.revoked = false; this.consumed = false; this.ciphertext = null; this.recipientCopy = null; this.key = null; this.iv = null; this.digest = ''; this.cipherDigest = ''; } async create(singleUse) { this.reset(); this.singleUse = singleUse; this.key = await crypto.subtle.generateKey({name: 'AES-GCM', length: 256}, false, ['encrypt', 'decrypt']); this.iv = crypto.getRandomValues(new Uint8Array(12)); const bytes = new TextEncoder().encode(sampleText); this.ciphertext = new Uint8Array(await crypto.subtle.encrypt({name: 'AES-GCM', iv: this.iv}, this.key, bytes)); this.digest = await HandoffModel.hash(bytes); this.cipherDigest = await HandoffModel.hash(this.ciphertext); this.created = true; } static async hash(bytes) { return Array.from(new Uint8Array(await crypto.subtle.digest('SHA-256', bytes)), b => b.toString(16).padStart(2, '0')).join(''); } get availability() { if (!this.created) return 'Create a sample first'; if (this.revoked) return 'Revoked'; if (this.clock >= this.expiry) return 'Expired'; if (this.consumed) return 'Single use consumed'; return 'Available'; } async fetchCopy() { if (this.availability !== 'Available') return {ok: false, reason: this.availability}; const plain = new Uint8Array(await crypto.subtle.decrypt({name: 'AES-GCM', iv: this.iv}, this.key, this.ciphertext)); this.recipientCopy = plain.slice(); if (this.singleUse) { this.consumed = true; this.ciphertext = null; } return {ok: true, digest: await HandoffModel.hash(this.recipientCopy)}; } expire() { if (this.created) { this.clock = 31; this.ciphertext = null; } } revoke() { if (this.created) { this.revoked = true; this.ciphertext = null; } } readCopy() { return this.recipientCopy ? new TextDecoder().decode(this.recipientCopy) : null; } } function createStudy() { const node = document.createElement('section'); node.className = 'lifecycle-study'; node.setAttribute('aria-label', 'Interactive local file handoff model'); node.innerHTML = `

LOCAL TEACHING MODEL · SYNTHETIC TEXT

Try the two sides of a handoff

All three roles are simulated in this browser tab. The encryption is real Web Crypto; access rules and time are a small local model. No file is uploaded or saved to disk.

Link policy

Hosted access · simulated

Create a sample first

Model clock: 0 minutes

Recipient copy · simulated

No copy yet

Kept only in this tab’s memory

Choose a policy, then create the synthetic sample.

Inspect the synthetic text and SHA-256 checks

Original text SHA-256

Not created

Ciphertext SHA-256

Not created

Recipient copy SHA-256

No copy yet

`; const model = new HandoffModel(); const get = name => node.querySelector(`[data-value="${name}"]`); const action = name => node.querySelector(`[data-action="${name}"]`); const policy = node.querySelector('select'); const status = node.querySelector('[role="status"]'); get('text').textContent = sampleText; let busy = false; async function paint() { get('host').textContent = model.availability; get('clock').textContent = `Model clock: ${model.clock} minutes · expiry at minute 30`; get('copy').textContent = model.recipientCopy ? 'Copy retained' : 'No copy yet'; get('original').textContent = model.digest || 'Not created'; get('cipher').textContent = model.cipherDigest || 'Not created'; get('recipient').textContent = model.recipientCopy ? await HandoffModel.hash(model.recipientCopy) : 'No copy yet'; for (const name of ['fetch', 'expire', 'revoke']) action(name).disabled = busy || !model.created; action('read').disabled = busy || !model.recipientCopy; action('create').disabled = busy; policy.disabled = busy; } async function run(fn) { if (busy) return; busy = true; await paint(); try { await fn(); } catch { status.textContent = 'The local example could not run. Use a browser with Web Crypto in a secure context.'; } finally { busy = false; await paint(); } } action('create').onclick = () => run(async () => { await model.create(policy.value === 'single'); get('output').hidden = true; status.textContent = 'Synthetic text encrypted. The model now holds ciphertext and allows a recipient fetch.'; }); action('fetch').onclick = () => run(async () => { const result = await model.fetchCopy(); status.textContent = result.ok ? (model.singleUse ? 'Recipient copy decrypted. The one-time gate is consumed; the recipient copy remains.' : 'Recipient copy decrypted. Hosted access is still available until expiry or revocation.') : `Another fetch is unavailable: ${result.reason}. ${model.recipientCopy ? 'The recipient’s earlier copy remains.' : 'No recipient copy was fetched.'}`; }); action('expire').onclick = () => run(async () => { model.expire(); status.textContent = `The model clock passed the expiry. Future hosted fetches stop. ${model.recipientCopy ? 'The recipient’s earlier copy remains.' : 'No recipient copy exists in this run.'}`; }); action('revoke').onclick = () => run(async () => { model.revoke(); status.textContent = `Hosted access revoked in the model. ${model.recipientCopy ? 'The recipient’s earlier copy remains.' : 'No recipient copy exists in this run.'}`; }); action('read').onclick = () => run(async () => { get('output').textContent = model.readCopy() || 'No copy yet'; get('output').hidden = false; status.textContent = 'Reading the simulated recipient’s in-memory copy requires no new hosted fetch.'; }); return {node, model}; } const study = createStudy(); const container = document.createElement("div"); container.className = "lifecycle-article"; container.append(study.node); display(container);4d:Td1c,

Imagine sending a finished client report. You want the client to retrieve it later, while keeping the hosted handoff short-lived. Encryption protects the file contents. The link policy controls future retrieval. Keeping an owner link private gives the sender a way to manage the hosted transfer.

Try these three sequences

Expiry before collection. Create a sample, advance the model clock, then try fetching. No recipient copy was created.
Collection before expiry. Create a new sample, fetch a recipient copy, then advance the clock. Read the recipient copy again: it survives the access change in the model.
One-time access. Select the one-time policy and create a new sample. Fetch once, then try fetching again. Read the earlier copy to see which side of the handoff still has the bytes.

What does revocation change?

Revocation stops future access through the hosted handoff. A recipient may already have saved a copy, forwarded it, or captured its contents. Set a sensible expiry, choose the intended recipient carefully, and treat a complete private sharing link with the same care as the file itself.

The model keeps a recipient copy only in this tab’s memory. A real downloaded file can persist on disk or elsewhere. Reloading this example clears its local state; that reset is a property of the example.

What do the hashes tell you?

The original synthetic text and the successfully decrypted recipient copy should have the same SHA-256 digest. This checks byte equality in this run. It does not tell you who read the file, whether the document was approved, or how many other copies exist.

Each sample uses a fresh random encryption key and a fresh 96-bit IV. The ciphertext digest changes between runs even though the synthetic text stays the same. No key or private file link is displayed or sent to a service.

Apply the distinction to a real handoff.

SEAL offers encryption before upload, sender-selected expiry and one-time download, and revocation of future hosted access. A saved recipient copy remains with its recipient.

Read SEAL’s temporary file sharing explanation

Sources and scope. MDN: SubtleCrypto.encrypt(); MDN: AES-GCM parameters and IV uniqueness; SEAL web documentation. The code is a deliberately small single-tab model with a simulated clock. It omits authentication, concurrency, network failures, storage deletion, and the full SEAL protocol. It is educational material from SEAL Team, not an independent review, a security audit, or a measured customer result.

4e:[] 47:{"id":"4b2315320e206997","slug":"one-time-download-links-where-expiry-ends","title":"One-time download links: where expiry ends","thumbnail":"7e95eced885e2378cf7c4fceab4e0a44ad14712c287ad9d642a44a1bbfc64bb1","access_level":"public","create_time":"$D2026-10-30T07:26:07.810Z","update_time":"$D2026-10-30T07:28:02.981Z","view_time":null,"first_public_time":"$D2026-10-30T07:31:36.360Z","has_unpublished_edits":null,"fork":false,"stars":0,"starred":false,"owner":{"type":"team","id":"d833985b817e1ac4","login":"seal","name":"seal","avatar_url":null,"tier":"free_2026","bio":"","followed_by_you":false,"follows_you":false},"version":14,"publish_version":14,"role":null,"authored":false,"authors":[{"type":"individual","id":"06c66ad195071532","login":"seal","name":"seal","avatar_url":null,"tier":null,"bio":"","followed_by_you":false,"follows_you":false}],"members":[{"type":"team","id":"d833985b817e1ac4","login":"seal","name":"seal","avatar_url":null,"tier":"free_2026","role":"editor"}],"comments":[],"custom_thumbnail":false,"trashed":false,"lapsed":null,"subscribed":null,"forks":0,"collection":null,"type":"notebook","body":{"titling":"auto","title":"One-time download links: where expiry ends","cells":[{"id":1,"value":"# One-time download links: where expiry ends","pinned":false,"hidden":false,"mode":"md","author":"$undefined","summary":"$undefined","tool":"$undefined","providerMetadata":"$undefined","attachments":"$undefined","output":"$undefined","database":"$undefined"},{"id":2,"value":"$4b","pinned":false,"hidden":false,"mode":"html","author":"$undefined","summary":"$undefined","tool":"$undefined","providerMetadata":"$undefined","attachments":"$undefined","output":"$undefined","database":"$undefined"},{"id":3,"value":"$4c","pinned":false,"hidden":false,"mode":"ts","author":"$undefined","summary":"$undefined","tool":"$undefined","providerMetadata":"$undefined","attachments":"$undefined","output":"$undefined","database":"$undefined"},{"id":4,"value":"$4d","pinned":false,"hidden":false,"mode":"html","author":"$undefined","summary":"$undefined","tool":"$undefined","providerMetadata":"$undefined","attachments":"$undefined","output":"$undefined","database":"$undefined"}],"files":"$W4e","stdlib":"2"}} 42:null