Ephemeral Private Paste

100% In-Browser

Zero-knowledge encrypted notes and secrets with automatic burn-after-reading and AES-256-GCM.

Key Capabilities & Features

  • ✓ 100% Client-side processing with zero server telemetry
  • ✓ Instant copy and download options
  • ✓ Clean formatting and auto-validation
  • ✓ No account or subscription required

How to Use Ephemeral Private Paste

Sharing confidential credentials, API keys, database connection strings, and private passwords across team communication channels like Slack, Teams, or email poses severe security risks. Chat transcripts are permanently recorded, searchable, and susceptible to data breaches. Ephemeral Private Paste solves this problem through zero-knowledge end-to-end encryption and "Burn After Reading" technology. Using the native Web Crypto API, your secret is encrypted in your browser with AES-256-GCM. The decryption key lives strictly in the URL hash fragment (#key=...), ensuring that our servers only ever receive unreadable ciphertext.

Step-by-Step Instructions

  1. 1.
    Compose Secret Note & Set TTL Expiry: Type or paste the sensitive information you need to transmit. Choose an expiration window (5 minutes, 1 hour, 24 hours, or 7 days).
  2. 2.
    Choose Burn-After-Reading or Zero-Storage Mode: Keep "Burn After Reading" enabled so the secret self-destructs the moment the recipient views it, or choose URL-only mode for zero server footprint.
  3. 3.
    Browser AES-256-GCM In-Memory Encryption: The Web Crypto API generates a cryptographically secure 256-bit AES key and 12-byte initialization vector (IV) to produce authenticated ciphertext.
  4. 4.
    Share Generated Decryption Link: Copy the unique permalink or display the QR code. The decryption key is encoded exclusively after the # hash fragment, isolating it from server logs.

Zero-Knowledge Cryptographic Architecture

Per W3C and IETF RFC 3986 standards, everything following the '#' character in a URL (the URI fragment) is strictly client-side and is NEVER transmitted over the wire in HTTP request headers. Because the decryption key is located solely in the hash fragment, the server hosting the ciphertext cannot decrypt or read your message under any circumstances.

Pro Tips & Best Practices

  • Transmit the link over your standard messaging app—even if your chat account is compromised later, the secret will already have burned.
  • Use the built-in QR Code generator to quickly transfer 2FA recovery keys or passwords directly from your laptop to your smartphone screen.
  • For short tokens under 500 characters, enable "Zero-Storage URL Mode" to bypass server storage completely.

Frequently Asked Questions

Can the server read my secret note?

No. Encryption happens in your browser before transmission. The 256-bit encryption key is placed exclusively in the URL hash fragment (#key=...), which per RFC 3986 is never transmitted in HTTP server requests.

What happens when "Burn After Reading" is enabled?

The moment the recipient opens the link and retrieves the ciphertext, the server permanently purges the record from memory.

Can the DailyToolbox server read my secret note?

Mathematically impossible. The encryption occurs in your browser before any network dispatch. The decryption key resides exclusively in the client-side URL hash (#key=...), which web browsers never send to servers.

What happens if someone opens the link twice?

When "Burn After Reading" is active, the ciphertext is permanently expunged from memory during the first retrieval. A second visitor sees a "Secret expired or destroyed" message.