SecurePaste

SecurePaste is a paste tool for text you should not put in a pastebin: config files, log excerpts, keys, blocks of code. It comes in two versions — a public one that needs no account, and a version inside the app for signed-in users.

The public tool

Open paste.credenshare.io and you get an editor straight away. There is no sign-up, no sign-in and no plan check. Type or paste your content, press Create Paste, and copy the link off the success screen.

Three things are worth knowing before you use it:

• It is free and sits outside every plan allowance. An anonymous paste is not attributed to an account, so it never draws on the share allowance of any plan — not even if you happen to be signed in to CredenShare in another tab. The public tool deliberately does not attach your session.
• The expiry is fixed at 24 hours. It is stated on the page, not offered as a control. Choosing a lifetime is an account feature; see the signed-in version below.
• The link opens once by default. That setting is a checkbox, so you can turn it off, but it starts on.

Burn after reading

The Burn after reading checkbox is on by default. With it on, the settings row reads Opens once, expires in 24h; with it off, Expires in 24 hours and the link keeps working until the expiry.

The success screen repeats the warning where it matters most:

This link opens once. Opening it expires it — so don't open it yourself to check.

Take that literally. There is no preview, no owner's copy and no dashboard entry — opening the link to see whether it worked is the same act as the recipient opening it.

The 24-hour expiry still applies underneath. It is the backstop for a link nobody ever opens.

Password

Tick Password and type one, and the recipient must enter it before the content will open.

The password is not a lock bolted on top of the ciphertext — it is folded into the key derivation, alongside the key in the link. A paste with a password cannot be read with the link alone, and cannot be read with the password alone. Send them through different channels.

On the public tool the password is available to everyone, because there is no plan to check. On the signed-in page it is gated — see below.

What is encrypted, and what is not

The paste body is encrypted in your browser with AES-256-GCM before anything is sent. CredenShare stores ciphertext and cannot read it. That holds on every plan and on the public tool alike; see Encryption.

The title is not encrypted. The public tool says so under the field:

Visible to CredenShare — keep secrets in the paste itself.

The title exists so a paste can be listed in a dashboard, which means the server has to be able to read it. Leave it blank and the paste is titled SecurePaste — <today's date>. Never put the secret, the hostname, the account name or the customer's name in the title.

Code and Markdown

Two formats, chosen with the toggle above the editor. The public tool labels them Code and Markdown; the signed-in page labels the same pair Source Code and Markdown.

The language list is the same on both SecurePaste surfaces: 46 entries — Plain Text plus 45 languages and formats, from Bash and Dockerfile through to YAML. The language you pick becomes the field's label for the recipient — Code (javascript), for example — who sees the content in a read-only, line-numbered block. Markdown is delivered as Markdown source, not rendered into a formatted document.

Download filename

The Filename field is optional, up to 255 characters. On the public tool its placeholder describes what it does:

Filename (optional) — e.g. notes.md, adds a Download button for viewers

Set it and a download button appears beside the copy action on the recipient's view, tooltipped Download as <your filename>, saving the paste under that exact name. Leave it blank and there is no download button — the recipient copies the text instead. The filename travels inside the encrypted blob, so unlike the title it is not visible to us.

Can I delete a paste?

Not from anywhere you can reach. An anonymous paste has no owner, so there is no dashboard entry, no edit screen and no revoke button. Once it exists you have two options:

1. Open the link yourself. If burn-after-reading was on, opening it spends the single view and the link is dead from that moment. Because a public paste is never marked owner-only, the view page also carries a Delete the Secure Share Forever button under the content — which is the only way to end a paste early when you turned burn-after-reading off.
2. Wait. After 24 hours it expires and the content is permanently deleted.

Anyone opening the link after either of those sees This share is no longer available.

The signed-in version

Signed-in users get SecurePaste inside the app, at app.credenshare.io/secure-paste. It is the same editor with a settings panel unlocked — the Settings button opens a drawer headed Paste Settings — and it produces a normal share rather than an anonymous one.

What changes:

• It counts against your plan's share allowance, exactly like a share created from the dashboard. Free is 3 per day; Solo 50, Basic 100, Plus 200 and Business 500 per billing month; Enterprise unlimited. Expired and deleted pastes still count.
• It appears in your Shares list, so you can see it, and end it without opening it. The list's delete action expires and scrubs the paste; the record moves to Expired Shares.
• You choose the expiry. Presets of 1h, 24h, 3d, 7d, 14d and 30d, or the slider — hours up to 24, days up to 31, or months up to 12. The default is 24 hours.
• A Team workspace is honoured. Create a paste with a team selected and it belongs to the team, is judged against the team's plan, and appears in the team's list.

The settings panel adds:

A gated row shows a plan lock and its switch is disabled. A Free account has no Password on this page — the one setting where the public tool is less restricted than the signed-in one.

Create Another clears everything you typed and every secret, while the policy settings — expiry, view limits, login and MFA requirements — deliberately carry over so you can create a batch under one policy. The success screen says so:

Creating another paste keeps your expiry and protection settings. The content, title, filename, description and any passcode are always cleared.

Reset, at the top of the Paste Settings drawer, drops the carried-over settings too.

Hostnames

Four hostnames turn up around SecurePaste. They are not interchangeable.

The legacy path app.credenshare.io/secure-paste-public still resolves; it redirects to https://paste.credenshare.io/.

If a paste will not create

The public tool runs a captcha and a proof-of-work check before it will accept a paste, because it is an unauthenticated endpoint. When the captcha fails you get:

Verification Failed

Captcha verification failed. Please refresh and try again.

Refresh the page and try once more. Pressing Create Paste with an empty editor gives Please enter some content instead.