If set, the recipient must enter this passphrase to view. Share it via a separate channel. We never store the passphrase—only a hash.