Loading...
Loading...
Send credit card numbers and CVV codes securely. Data is encrypted in your browser before sending.
Credit-card numbers move between people more often than the financial industry would like to admit. A spouse pays for a flight on a partner's card, a parent covers a child's emergency expense, an executive assistant books travel for an executive, an online merchant takes a phone-order from a customer with no other payment rail. The card number, expiry, and CVV all have to leave one set of hands and arrive at another.
The default channels are uniformly bad. A photo of the card lands in your camera roll and uploads to iCloud or Google Photos, where it is searchable by OCR. A text message sits in iMessage forever, syncing to every device on the family Apple ID. Email drafts get auto-saved with the card number visible to anyone with mailbox access. Once the number is in any of these surfaces, you can rotate the card — but the underlying carelessness habit does not get fixed.
PasteOnce handles the handoff as a one-shot, encrypted transfer. The number never enters any persistent surface; the recipient reads it, types it into the merchant's terminal, and the link is dead. For repeat or merchant-side use, virtual cards (Privacy.com, Capital One Eno, Apple Card numbers) are still the gold standard — but for a one-time handoff between people, this is dramatically better than the alternatives.
Client-side encrypted. We can't see your data.
Your data is encrypted in your browser before it leaves your device.
Messages are automatically deleted after being read once.
We never see your data. Only encrypted blobs pass through our servers.
Links work exactly once. Refresh the page and it's gone forever.
Your sensitive data is encrypted in your browser using AES-256-GCM. The encryption key is generated randomly and never sent to our servers.
Only the encrypted blob is stored in our database, with an automatic expiration time. We literally cannot read your data.
When your recipient opens the link, the encrypted data is fetched and immediately deleted from our servers using an atomic Redis GETDEL. The key in the URL hash decrypts the message in their browser.
Privacy.com, Capital One Eno, Apple Card per-merchant numbers, and many bank-issued virtual-card features generate a single-use or merchant-locked card number. The original card never leaves your wallet.
Send the number and expiry via PasteOnce; send the CVV via SMS or call. An attacker now needs to compromise two distinct channels to use the card.
Enable instant transaction alerts in your bank's app the moment before you share. Any rogue charge surfaces in seconds, before the attacker can cash out.
There is no reason for a credit-card link to live longer than the recipient's coffee break. Pick the shortest available expiration.
Your sister cannot reach a desk to book a flight; you have her card details memorized for the family streaming subscription. PasteOnce her card to the airline's customer-service rep, complete the booking, and the link is gone within minutes.
An executive needs an EA to pay an invoice on the executive's personal card. PasteOnce the card details, the EA pays the invoice, and you have avoided pasting card data into the EA's email or Teams channel.
A small-business merchant takes a phone order from a customer who would rather not read the number aloud over a public line. The customer PasteOnces the number; the merchant types it into the terminal. Note: this is a stopgap — a real card-present or 3DS terminal is the right answer for repeat use.
PCI DSS does not apply to individuals or to one-off person-to-person transfers; it applies to merchants who store, process, or transmit cardholder data. PasteOnce is not a payment-processing tool — for merchant flows, use a real PCI-compliant payment processor.
Yes, but consider sending those details via a different channel than the card number itself. Defense in depth — separating the components means an attacker needs to compromise more than one channel.
Use a proper card-present terminal or a virtual-terminal product (Stripe Terminal, Square virtual terminal). PasteOnce is not a substitute for a payment rail — it is only a substitute for texting the number.
No — PasteOnce is not visible to your bank. But your bank will see the resulting transaction, and a fraud alert may flag it if the merchant or pattern is unusual. Whitelist the merchant in advance if you can.