snippet.sh New paste

Send a password or an API key with a one-time link

A password that you send in a chat message or an email stays there for years. With snippet.sh, you send a link instead. The link opens one time, and it expires in 1 hour or less. Your browser encrypts the text. The service is free, and an account is not necessary.

Steps

  1. Open the home page and paste the secret: a password, an API key, a token, or the content of an .env file.
  2. Select when the paste expires. Use the shortest time that is sufficient for the other person.
  3. Select Delete after the first read.
  4. Select Create link and send the link to the person who needs the secret.

What the other person sees

The link opens a page with one button, Show the paste. When the person selects the button, the browser gets the encrypted text, decrypts it, and shows it. At the same time, the server deletes the paste. If a person opens the link again, the page says that the paste is not available.

If the other person tells you that the paste was not available, a different person possibly read it first. Change that password immediately.

Why this is safe

  • The server cannot read the secret. Your browser encrypts the text with AES-GCM and a new 128-bit key. The key is in the link, after the # character. A browser does not send that part of a link to a server.
  • The link opens one time. The server deletes the paste in the same step that gives it to the first reader.
  • A link preview does not delete the paste. Chat applications, such as Slack and Microsoft Teams, open each link to make a preview. The paste stays available.
  • The secret does not stay on the server. If no person opens the link, the service deletes the paste after 5 minutes to 1 hour.

What it does not protect against

  • A person who gets the full link before the correct person can read the secret. Send the link directly to one person.
  • It cannot protect a secret on a computer that is not safe.
  • It is not a password manager. For a secret that a team uses for a long time, use a password manager or a secrets manager.

Good practice

  • Put only the secret in the paste. Tell the other person in a different message which account or system it is for.
  • Do not send secrets from a terminal with curl. A terminal upload is not end-to-end encrypted. The terminal guide shows the correct uses of the terminal.