Loading...
Loading...
Send environment variables and config secrets to your team without using Slack or Email.
.env files are the de-facto secret store for modern web applications. A typical file holds database connection strings, third-party API keys, JWT signing secrets, OAuth client secrets, SMTP credentials, and webhook signing keys — each one a distinct credential, often each with a different blast radius. The file represents the keys to the kingdom for the application it belongs to.
Dropping a .env file into Slack is the most common dev secret leak we see. The file's name itself triggers automated bot scanners (DATABASE_URL=, STRIPE_SECRET=), and Slack's file retention rules typically keep the upload accessible for years even after a manual delete. Many companies' incident retrospectives trace back to a single .env paste in a private channel that someone later compromised.
PasteOnce changes the handoff to a single round-trip: the sender pastes the file's contents (or the subset needed), the recipient reads the link once, and the ciphertext is gone. The encrypted blob never touches a chat tool's database, never appears in a workspace export, and is not searchable by anyone — including us.
Client-side encrypted. We can't see your data.
Your data is encrypted in your browser before it leaves your device.
Messages are automatically deleted after being read once.
We never see your data. Only encrypted blobs pass through our servers.
Links work exactly once. Refresh the page and it's gone forever.
Your sensitive data is encrypted in your browser using AES-256-GCM. The encryption key is generated randomly and never sent to our servers.
Only the encrypted blob is stored in our database, with an automatic expiration time. We literally cannot read your data.
When your recipient opens the link, the encrypted data is fetched and immediately deleted from our servers using an atomic Redis GETDEL. The key in the URL hash decrypts the message in their browser.
If a teammate is debugging the auth flow, they do not need the analytics keys. Trim the paste to the relevant lines — every secret left out is one less to rotate later.
Doppler, Infisical, and Vault sync .env values to local development without ever materializing the full file. Use PasteOnce for the bootstrap; use a manager for steady state.
Do not try to triage which leaked vars matter. Treat a leaked .env as if every line is compromised, because in practice attackers will try every value against every plausible service.
Run 'git log -p -- .env' and 'git rev-list --all | xargs git grep -l SECRET' to surface any past commits. Use BFG or git filter-repo to scrub them, then rotate everything found.
A new hire needs the local .env to run the app. PasteOnce the file once on day one. They copy it into their local repo, the link expires, and you have avoided creating any persistent record of the file outside their machine.
The frontend developer only needs the NEXT_PUBLIC_* vars (which end up in the bundle anyway). Send those plain — and PasteOnce only the server-side secrets to the backend developer who actually needs them.
While pair-debugging over a screen-share, you realize the staging .env does not match what is in production. PasteOnce the diff; recipient overwrites; debug continues without a permanent leak in the screen-share recording.
Just the variables they need. Every secret you do not share is one fewer to rotate if the link goes wrong, and one fewer audit-trail concern down the road.
The link is one-time — once the first recipient opens it, the second person sees only an expired-link error. To share with multiple people, create one link per person. This is a feature, not a bug.
No. Variables prefixed with NEXT_PUBLIC_ in Next.js (and similar in other frameworks) end up in the public client bundle and are visible in the user's browser. Sharing them in plain Slack is fine; reserve PasteOnce for actual secrets.
The textarea limits plaintext to 500,000 characters and the encrypted blob is capped at 1,000,000 characters. A typical .env is a few hundred lines at most — well within bounds.