Loading...
Loading...
Send a text message that can only be read once. It disappears forever after opening.
A one-time text is the small string that has to land in someone's eyes and then evaporate. The verification code your aunt reads aloud while a fraud-line agent waits on hold. The brief 'spare key is taped under the planter, not the mat' you fire from a taxi to a friend feeding the cat. A confirmation number a relative repeats to a pharmacy. Three to thirty characters, seconds of relevance.
The native channel for messages this size is SMS, and that is where the headline failure mode lives. iOS and Pixel devices ship with notification previews enabled by default, so the body of an incoming text renders inside the lock-screen banner before face or fingerprint unlocks the phone. A six-digit code is legible at arm's length on a desk, a car dock, a paired watch face, or the kitchen smart display.
PasteOnce keeps the payload off that surface. You paste the digits, send a link through whichever messenger the recipient uses, and the bystander sees only a pasteonce.link URL with no readable contents. They tap, the ciphertext is destroyed during the same request, and the value sits on screen for the few seconds it has to. Re-reading is impossible — the point of a string that loses meaning the moment it is used.
Client-side encrypted. We can't see your data.
Your data is encrypted in your browser before it leaves your device.
Messages are automatically deleted after being read once.
We never see your data. Only encrypted blobs pass through our servers.
Links work exactly once. Refresh the page and it's gone forever.
Your sensitive data is encrypted in your browser using AES-256-GCM. The encryption key is generated randomly and never sent to our servers.
Only the encrypted blob is stored in our database, with an automatic expiration time. We literally cannot read your data.
When your recipient opens the link, the encrypted data is fetched and immediately deleted from our servers using an atomic Redis GETDEL. The key in the URL hash decrypts the message in their browser.
Walk them through Settings then Notifications then Show Previews then When Unlocked on iOS, or Notifications then Lock screen then Hide sensitive content on Android. A five-minute fix covers every short message after.
Verification codes from banks and 2FA providers already expire in 30 to 600 seconds at the source. Pick the shortest TTL so the encrypted blob dies before the underlying code itself would.
Send '8842' or 'south gate, blue door' rather than the bank-branded SMS or full property address. A glanced-at payload with no nouns names neither institution nor location, so an accidental reader cannot match value to target.
If you are on a voice line and the round-trip will not fit in the verification window, speak the digits. A second link doubles lock-screen exposure on their device for no gain in privacy or speed.
Your father is on the phone with his bank's fraud line and they have SMSed him a six-digit code he cannot read through the kitchen-window glare. He calls you over speakerphone, you PasteOnce the digits to your sister at his house, and she reads them to the rep before the call ends.
A friend is on the way to feed your cat and the spare key got moved. You paste 'taped under the rosemary planter, not the mat' into PasteOnce and fire the link over iMessage; they read it on your porch, not in a thread your roommate scrolls.
Your partner is on hold with the pharmacy and needs a confirmation string from an email open on your laptop. A link gets it onto their phone without leaving the value in iMessage history that syncs to the iPad the kids use on flights.
Open Settings then Notifications then Show Previews and pick When Unlocked or Never. The first holds the body until Face ID confirms you; the second hides it even when unlocked. Android offers the same control under Notifications on lock screen.
You can, but the code already lit up your own device and any paired watch, car, or tablet on the way in. The biggest privacy win is when the value originates with you — a PIN, a confirmation read off a desktop — and the surface you protect is the recipient's lock screen.
For a single four-digit number on a quiet line, a call wins. The link wins when digits run longer than seven characters, when accents make 'five' and 'nine' confusable, or when both parties want no call-log entry afterwards.
The URL preview appears in whichever messenger you used, like any other link. It contains only an opaque note ID and a fragment with the decryption key — no readable content. A bystander sees a pasteonce.link domain, not the digits inside.