Loading...
Loading...
Share temporary access codes or 2FA backup codes securely with employees or clients.
A temporary PIN is the short numeric string that opens a physical thing — a Schlage Encode front door, an August Wi-Fi Smart Lock, a Yale Assure, a Wyze Lock Bolt, a Brivo or Kisi commercial reader, a Sentrilock or Supra real-estate lockbox, a hotel-room safe. Four to eight digits decide whether the cleaner gets in at 9 AM, whether the contractor reaches the breaker panel, whether a buyer's agent can show on Saturday.
Treating these codes like passwords is the mistake. People reuse the same four digits across a debit card, ATM, garage keypad, and office back door, because four digits are memorable and humans hate friction. A code texted in plain SMS lands on a lock-screen preview and in iMessage cloud backup. Workplace DMs sit in admin exports indefinitely; a pasted door code from 2024 is still legible to whoever runs the next eDiscovery hold.
PasteOnce is shaped for this handoff. Generate the code inside the lock vendor's app — August, Yale Access, Schlage Home, Brivo Mobile Pass, igloohome — paste it once, hand the recipient a link that dies after a single read, and pair the link's TTL with the lock's auto-expiration so both timers retire together. The PIN lives in the recipient's short-term memory, not in a chat scrollback that outlives the visit by years.
Client-side encrypted. We can't see your data.
Your data is encrypted in your browser before it leaves your device.
Messages are automatically deleted after being read once.
We never see your data. Only encrypted blobs pass through our servers.
Links work exactly once. Refresh the page and it's gone forever.
Your sensitive data is encrypted in your browser using AES-256-GCM. The encryption key is generated randomly and never sent to our servers.
Only the encrypted blob is stored in our database, with an automatic expiration time. We literally cannot read your data.
When your recipient opens the link, the encrypted data is fetched and immediately deleted from our servers using an atomic Redis GETDEL. The key in the URL hash decrypts the message in their browser.
Inside August, Schlage Home, Yale Access, igloohome, or Brivo, set the access window to the actual visit hours — Tuesday 9–11 AM. Then send the PIN with PasteOnce's 1-hour TTL so the link dies before the visit starts.
Every smart-lock platform supports unique guest codes. Use Schlage's Guest Access, Yale's Visitor PIN, August's Guest Keys, or Brivo's per-credential ID — and rotate any code spoken aloud or sent unencrypted.
Four digits give 10,000 combinations; six give a million. For commercial Brivo or Kisi panels and high-value vaults, configure six or eight digits and require a 5-attempt lockout to defeat physical brute-force at the keypad.
Send the PIN via PasteOnce; send the unit number, gate instructions, or building address through ordinary chat. Splitting the two means a leaked link does not also reveal which door it opens.
You manage a short-term rental on August or Yale and the cleaner needs entry between turnover guests. Generate a Tuesday 9 AM-noon guest code, paste the digits into PasteOnce with the 6-hour TTL, send the link overnight. By turnover, both code and link are dead.
A buyer's agent needs the lockbox combination for a 30-minute Saturday showing. Text the address normally, then PasteOnce the box code separately. After the showing, rotate the code in the eKey app — the leak window was a coffee break.
An electrician arrives to swap a panel and needs the back-door PIN for the commercial Brivo reader. Issue a one-day Brivo credential, send the PIN via PasteOnce while en route, and the credential expires automatically at end of day.
Different problem. Recovery codes unlock an online account when the authenticator is lost; a temporary PIN unlocks a physical thing — a door, a vault, a lockbox. Recovery codes belong in a password manager for years; an access PIN should expire within hours of the visit.
When the recipient has the same vendor app installed, yes — August Guest Keys, Schlage Home invites, and Brivo Mobile Pass are the cleanest path. PasteOnce covers the case when the recipient has no app or a one-off contractor.
Four digits is the floor — fine for low-stakes residential use where the lock locks out after three wrong tries. For a vacation rental, Airbnb door, or any door strangers cycle through, set six. Commercial readers in sensitive areas should run eight.
No. The code is encrypted in the browser with AES-256-GCM before the request leaves the page, and the URL fragment holding the decryption key is never transmitted. We hold an opaque ciphertext blob with a TTL and nothing else.