— disposable clipboard
Share it.
Read it.
Gone.
Transfer text, images, documents, audio, video, and more between any devices using a disposable 6-digit code. No account. No link. No history. Content erases itself.
Hard TTL — no exceptions
No links, no URLs
Per transfer, max
Fully anonymous
// how_it_works()
Push
Paste text or drop a file. Hit generate. You receive a fresh 6-digit code tied to your content.
Tell them the code
Say it out loud, type it in a chat, or show your screen. No URLs to copy and paste.
Pull on any device
Enter the 6 digits anywhere. Content appears — then is permanently erased from the server.
// security
Designed to
leave no trace.
Every technical decision optimises for minimum data exposure. Here is what we actually do — not what we claim.
- Burn after reading
- Content is deleted from storage in the same atomic operation as the read. There is no second retrieval — ever.
- Cryptographically secure codes
- Codes are generated using Node's crypto.randomInt(), not Math.random(). Outputs cannot be predicted from prior observations.
- Strict MIME allowlist
- Only known-safe formats are accepted: images, documents, archives, audio, video, and fonts. Validation is server-side against a hardcoded list — filename extensions are ignored. SVG is permanently blocked.
- Atomic write (SET NX)
- Redis SET NX guarantees only one writer can claim a code. Two concurrent pushes cannot silently collide and overwrite each other.
- Rate-limited API
- Both endpoints are capped at 10 req/min/IP. Brute-forcing all 900 000 possible codes at this rate would take over 62 days.
- Zero logs
- No IPs, no user-agents, no content hashes are persisted. We record nothing that could identify what was shared or by whom.
// use_cases()
→
Wi-Fi passwords
Hand a network password to a guest's phone without typing or revealing your router admin page.
→
Tokens & secrets
Move an API key, env var, or terminal command across machines without emailing yourself.
→
Screenshots
Took a screenshot on your work laptop. Need it on your phone right now. Done in 10 seconds.
→
One-time PDFs
Send a document that destroys itself once the recipient has saved it on their end.
// api_access()
Push & pull
from code.
A simple REST API for CI pipelines, scripts, and integrations. Authenticate with a Bearer token and transfer anything your plan allows.
Developer
- → 10 MB max file size
- → 1,000 requests / day
- → 1-hour TTL
Pro
- → 100 MB max file size
- → Unlimited requests
- → 24-hour TTL
# Push text
curl -X POST https://yourdomain.com/api/v1/clip \
-H "Authorization: Bearer <your-key>" \
-H "Content-Type: application/json" \
-d '{"text": "hello world"}'
# → {"code":"482193","expires_in":3600,"requests_remaining":999}
# Pull content
curl https://yourdomain.com/api/v1/clip/482193 \
-H "Authorization: Bearer <your-key>"Keys provisioned automatically on purchase via Polar.sh. Full API reference →
// our_commitment
Minimal data.
By design.
FastPaste was built around a single principle: retain nothing that you don't have to. The server holds exactly one thing — the payload you chose to share — and only until it is claimed or the 10-minute clock expires. At that point it is gone, with no backup copy and no logs.
We never ask for an account because we don't need one. We never log IP addresses because they would be personally identifiable data we have no reason to store. We don't track page views, generate analytics events, or load third-party scripts. The page you're reading contains zero external dependencies at runtime.
The server is self-hosted — your content is never routed through a CDN or a third-party storage bucket. Codes are generated with a cryptographically secure PRNG. All API endpoints enforce strict input validation, file-type allowlists, and IP-based rate limiting.