Access Codes & Secret Links for Shared Portfolios

How to publish an anonymous percentage-only portfolio to the public while granting confidential access to exact financial amounts via passwords or expiring links.

1. The Need for Selective Data Unmasking

Many private investors, analysts, and financial bloggers want to share investment allocations and track records publicly, but prefer not to disclose the actual monetary size of their net worth. For this purpose, Firewire provides an anonymous sharing mode («Hide exact amounts in RUB»), where visitors only see percentage weights and relative yield metrics.

However, you frequently need to reveal actual figures to trusted parties:

• Co-investors or business partners: to verify joint capital and split returns.
• Financial advisors or tax consultants: for in-depth balance auditing, rebalancing advice, and tax deduction planning.
• Family members: for household wealth tracking.
• Prospective fund investors: for a confidential one-off audit of strategy performance.

Instead of cloning public pages with divergent settings, Firewire enables managing fine-grained access directly on a single shared portfolio.

2. Permanent Master Password

The Master Password is a persistent secret code set by the portfolio author. Any visitor who enters this code can unmask currency figures during their browsing session.

Setting up a Master Password:

1. Navigate to «Settings» → «Communities & Access».
2. Under «Public Links», find your page and click the «Access» button (or open the page in the Page Builder).
3. Ensure the «Allow unmasking» toggle is turned on.
4. In the Master Password section, enter your desired password or click the «Generate random code» icon for strong entropy.
5. Click «Save Password».

How Visitors Unlock Data:

1. The visitor opens the shared link. If amounts are concealed, a 🔒 «Unmask Data» button appears in the header.
2. Clicking the button opens a modal prompt requesting the password or access code.
3. Once validated by the server, real balances, net return numbers, and passive income streams are displayed, and the button flips to 🔓 «Data Unmasked».
4. The visitor can click the button at any time and select «Hide Data» to restore privacy.

3. Temporary & Single-Use Secret Links

Asking busy partners or clients to manually type a password can be cumbersome. For frictionless sharing, you can create temporary secret links with embedded tokens: https://fire-wire.ru/shared/my-portfolio?key=fw_sec_....

Secret Link Parameters:

• Name or Recipient: an identifying label (e.g. «For Auditor», «Investor John», «Q3 Pitch») shown in your link audit table.
• Expiration Time:
  • 1 hour — ideal for quick video calls and screen sharing.
  • 24 hours (1 day) — for single-day evaluation.
  • 7 days or 30 days — for quarterly due diligence periods.
  • Never — remains active until manually revoked by the author.
• Usage Limits:
  • 1 use (Single-use) — expires immediately after the first successful page load.
  • Custom limit N — ceases to unmask values after N separate arrivals.
  • 0 (Unlimited) — unconstrained visits within the valid timeframe.

Automatic Browser URL Sanitization:

When someone arrives via a secret link, Firewire performs three protective actions:

1. Verifies the secret token on the server and loads genuine account balances. The key travels in the X-Shared-Page-Key request header rather than in the API address, so it does not end up in proxy or web server logs.
2. Caches the authenticated key inside the tab's sessionStorage.
3. Instantly strips the sensitive ?key=... parameter from the browser URL bar using window.history.replaceState().

This guarantees that if the recipient copies the address bar or screenshots the browser, the secret key is never leaked to unintended viewers.

4. Hidden Notes

«Hide exact ruble amounts» masks only the numbers that come from your portfolio data. The text of notes («Note» in the builder) is written by you, and by default everyone with the link can read it. If a note contains personal figures — a mortgage, expenses, a renovation budget — hide it behind the same password as the amounts.

How to hide a note:

1. In the page builder, turn on «Allow unmasking» and set a master password.
2. Click ⚙ on the note and turn on «Hide text until unmasked». A 🔒 badge appears on the note.
3. Save the page.

What visitors see:

• Without the password: a placeholder of the same size — «The author hid this note — unlock it with the password» — with an «Unmask data» button. The server never sends the title or text of such a note: not on the page, not in embeds (?embed=true), not in public listings, so DevTools reveal nothing.
• After the password or a secret link: the text appears instantly, without a reload. «Mask again» hides it once more.
• You, the author, see and edit the text as usual — in the builder and in «Configure» mode.

5. Access Center & Token Audit

Inside the Access Modal in the Shared Pages Manager, you can monitor and control all generated access links:

• Usage Counter: reflects exact visit numbers (e.g. 1 / 1 or 4 / 10).
• Status Badges: links are clearly marked as «Expired» or «Limit Reached» when criteria are met.
• Instant Revocation: clicking the trash icon immediately invalidates the token in PostgreSQL. Further visits will strictly receive masked figures.

6. Cryptographic Architecture & Data Minimization

Firewire strictly adheres to Zero-Knowledge Masking and Data Minimization principles:

• Salted PBKDF2: master passwords are never stored in plain text. The server generates a unique salt per page, hashes the password with PBKDF2-HMAC-SHA-256 (210,000 iterations) and compares hashes in constant time. Passwords saved before the switch to PBKDF2 keep working and are re-hashed into the new format on the first correct entry.
• Hashed Token Storage: dynamic tokens are stored solely as SHA-256 hashes. The plain key is displayed only once during creation and cannot be retrieved from the database later.
• Server-Side Masking: if no valid key is provided, genuine balance numbers are never sent to the client. Real figures are replaced with masking constants before JSON serialization, preventing any DevTools inspection leaks.

7. Frequently Asked Questions (FAQ)