Paste Locker
Share a secret behind an eight character code. Add a password, give it an expiry, or let it burn so the first reader is the only reader.
New note
POST /api/create-noteOpen a note
POST /api/read-noteEvery fresh deploy ships one note.
Nothing open yet
Enter a code above, or follow a share link, and the note lands here.
Opening the note
The code is with the function that holds the notes table.
This note is locked
It was sealed with a password. Type the password above and the note opens here.
The note did not open
Try the code once more in a moment.
Why a serverless function
The notes table is not published on the REST API at all. This page cannot query it, and neither can anyone else. The only way in is two functions that run on the server.
- Creating a note posts it to
/api/create-note. - That function hashes your password with scrypt, a one way function, then forgets the password.
- Only the hash is stored, never the password itself.
- Opening a note posts the code and the password to
/api/read-note, which hashes the attempt and compares it against the stored hash.
A browser cannot do this part. If the hash were handed to the page, anyone could take it away and try guesses offline for as long as they liked. Burning a note has the same problem: decide "already read" in the browser and two readers can both win the race, so the function settles it in one database statement.