share-pad
Share a snippet of text via a short 6-digit code (stored temporarily on a server) or an offline URL-hash link where the full content is compressed into the URL itself — no account required, nothing to install.
// sharing options explained
Quick Share Link — The same 6-digit code embedded in a link (#code=482195), so opening it decrypts and shows the text automatically with nothing to type. It's the code above, just easier to click. The code lives after the #, which browsers never send to a server — see why the hash fragment is never transmitted.
Offline Fallback Link — The entire text is compressed (GZIP) and encoded directly into the URL hash fragment. Nothing is sent to any server — the URL itself contains all the data. The recipient's browser decompresses it locally when they open the link. The trade-off: the URL can get very long for large inputs, which some messaging apps may truncate or reject.
// privacy considerations
The 6-digit code path encrypts before storing, but don't mistake that for a guarantee: the code is both the lookup key and the decryption key, so anyone with direct read access to the underlying data store — not network access, direct access — could decrypt an entry using its own key. That's a meaningfully different (and much smaller) threat than "stored as plaintext," but it's not the same as end-to-end encryption between two people who never trust a third party. Don't share passwords, production secrets, private keys, or personal data through it. For anything sensitive, use the offline fallback link instead — the data never leaves your browser and the recipient's, and the server never sees it at all. That said, if the link itself gets logged somewhere (a proxy, a chat client, a browser extension with page access), the data in the hash is exposed regardless of how it got there — treat the offline link as convenient, not as end-to-end secure messaging.
6-Digit Code — A short code like
482 195that's easy to read out, type, or paste. Before anything is sent anywhere, your text is encrypted in your browser (AES-256-GCM, key derived from the code itself via PBKDF2) — the server only ever stores ciphertext, never your plaintext. The code doubles as the decryption key, so it works standalone: read it out over a call, or send it any way you like. Retrieval needs a network round-trip, and a code keeps working for 30 days (it isn't consumed after one read).