Paste: encrypted links for passwords and files
Paste turns a message or a set of files into a link. Everything is encrypted in your browser before it uploads, the link carries the key, and you decide whether it deletes itself after the first view or expires on a date.
Creating a paste needs a free Pea account. Opening one never does.
- Wi-Fi password, Oak St officeOpened and deletedMessage · opens once · opened Sep 24, 2:14 PM
- Staging API keyWaitingMessage · password · sent 2 hours ago · expires in 6 days
- Signed leaseOpened2 files · opened 3 times, last Sep 22, 4:40 PM
- Router admin loginDestroyedMessage · password · 10 wrong tries on Sep 19
Four steps from secret to link
Most pastes take under a minute, and the recipient needs nothing but a browser.
Write it or attach it
Type a message, attach files, or both. File names and types are packed inside the encrypted data, so they’re hidden from us as well.
Choose how it ends
Set an expiry of 1 hour, 1 day, 7, 30 or 90 days, or none. Leave burn after reading on and the paste is deleted the moment it’s opened. A password adds a second lock, and it works best sent through a different channel than the link.
Send the link or the code
You get a link and a 10-character code that can be typed by hand. The recipient opens the link, or types the code at pea.dev/p, with no account.
Check what happened
The Sent tab shows every link you’ve made and its current state, so you know whether it reached the person before you assume it did.
A record of every link you send
Each paste keeps a status line after it’s created. You’ll see when it was first opened, when it was last opened and how many times, and how it ended. Only the status is kept, since the contents were encrypted before they left your browser, so the Sent tab can tell you a link was opened but never what was inside it.
Wrong password attempts show up on a waiting link as they happen. Delete now stops a link from working before it’s opened, and Remove clears a finished one from your list.
| Status | What it means |
|---|---|
| Waiting | The link works and nobody has opened it yet |
| Opened | How many times it was opened, and when it was last opened |
| Opened and deleted | Burned after reading, with the time it was opened |
| Expired | Reached its expiry date and was deleted |
| Destroyed | Deleted itself after 10 wrong passwords |
The encryption, in plain terms
Paste uses the Web Crypto API built into your browser. The code that encrypts runs on the page you are looking at, so anyone can read it in the browser’s developer tools.
- AES-256-GCM encrypts the message and files before upload, and the server receives ciphertext only
- The key lives in the link. On short links your browser stretches the 10-character code with PBKDF2 (600,000 rounds) into a locator it sends and a key it keeps
- Passwords are stretched the same way and mixed into the key, and 10 wrong attempts destroy the paste
- Proof of the key is required to download the ciphertext, so someone who only knows a paste’s ID can neither read it nor burn it
- Each paste is bound to its ID, so ciphertext can’t be moved to a different link
- What we store is the ciphertext, a random salt, a hash used to check the key, the expiry and the open history
What people send with Paste
- Wi-Fi, router and alarm codes handed to a tenant, client or new employee
- API keys and server credentials shared with a contractor for one job
- Account recovery codes moved between your own devices
- Signed documents and IDs that shouldn’t sit in an inbox for years
Paste FAQ
Can Pea read what I send?
No. The text and files are encrypted in your browser before they upload, and the key is part of the link or code, which never reaches our server. We store ciphertext that we have no way to open.
Does the person I send it to need an account?
No. They open the link, or go to pea.dev/p and type the 10-character code. Only creating a paste needs a Pea account.
What if I lose the link or the code?
We can’t recover it, because we never had a copy of the key. The paste will expire on schedule, or you can delete it from your Sent tab and make a new one.
Why should the password go separately?
If the link and the password travel in the same email or chat, anyone who reads that message has both. Sending the password by text or phone call means a leaked message alone can’t open the paste.
How is this better than email or Slack?
A password pasted into an email or chat stays in both inboxes, in search, and in every backup for years. A paste can be read once and then deleted, and you can see whether and when it was opened.
Is Paste free?
Yes. Paste is included with a free Pea account.
Send your first encrypted link
Sign in with your Pea account, or create one for free, and your first paste is a minute away.