On this page
Wi-Fi passwords, door codes, a draft contract, a recovery phrase you're moving between devices — some things shouldn't sit in a chat history forever. Thpaste gives you four independent controls, and you can stack them: who can find it, who can open it, how many times, and for how long.
The four controls
The default. The paste isn't listed anywhere — only people with the link can open it.
Readers must type the password before a single word of the paste is sent to their browser.
The paste is deleted from the server the moment it's first opened.
The paste disappears on its own after 10 minutes, 1 hour, 1 day, 1 week or 1 month.
How long each expiry keeps a paste
Pick the shortest window that still gives your reader time to open it. Never-expiring pastes stay until you delete them (with an account) — good for documents, bad for secrets.
Password protection, step by step
- 1Type a password under Access
Anything works — share it with your reader through a different channel than the link.
- 2Publish
The paste page shows only its "Protected paste" heading. Not even the real title is sent until the password is right.
- 3Your reader unlocks it
They type the password and the paste appears. A wrong password just asks again.
Send the link and the password separately
Link by email, password by text message (or vice versa). Someone who intercepts one channel still can't read the paste.
Burn after reading: one look, then gone
Choose Burn after reading in the Expires menu. When you publish, Thpaste shows you the link to copy instead of opening the paste — so you can't burn it by accident. The first time the paste is opened, its content is sent to that reader and deleted from the server in the same moment. The reader sees a clear notice — this paste has now been destroyed; save what you need — and the link never works again.
Link previews can't steal the view
Messaging apps often "peek" at links to build a preview. Thpaste only burns a paste when a real person opens the page in their browser, not when an app fetches the link.
Which combination should I use?
| Situation | Unlisted | Password | Burn | Expiry |
|---|---|---|---|---|
| Share a code snippet with a colleague | ✓ | ✗ | ✗ | 1 week |
| Send a Wi-Fi or door code to a guest | ✓ | ~ | ✓ | 1 day |
| Pass an API key to a teammate | ✓ | ✓ | ✓ | 1 hour |
| Share meeting notes with a team | ✓ | ✓ | ✗ | 1 month |
| A one-time recovery code | ✓ | ✓ | ✓ | 10 minutes |
| A public guide you want discovered | ✗ | ✗ | ✗ | Never |
(~ = optional: a password helps if the link might be forwarded.)
Good habits for sensitive pastes
- Use burn after reading for anything that's only needed once
- Add a password whenever the link travels through a group chat
- Choose the shortest expiry that works
- Send link and password through different channels
- Never post real secrets in a public paste
What Thpaste does behind the scenes
- Password-protected pastes never send their title or text to the browser until the password matches.
- Burned and expired pastes are deleted from the database, not just hidden.
- Paste pages tell search engines not to index them.
- Pastes never load pictures from other websites, so a paste can't secretly track who opened it.
FAQ
Can I tell whether my burn-after-reading paste was opened?
Yes — open the link yourself afterwards: if it says the paste is gone, it has been read (or it expired). Just don't open it before your reader does, or you'll burn it yourself.
What happens if I forget the password?
There's no recovery: Thpaste doesn't keep the password, only a fingerprint of it. Make a new paste.
Is "unlisted" the same as private?
Unlisted means nobody can find it without the link. If the link might be shared further, add a password.
Share your next secret safely
Unlisted by default — add a password, burn after reading or an expiry in one click.
Create a private paste
