Clipboard Sharing Online
Type a password, length min 4
Clipboard text is encrypted in your browser, never sent or stored directly
Password is never sent nor stored
Rooms can be private, sealing when full so no one else can enter
Highly configurable but simple by default
What is Clipboard Sharing Online?
Clipboard Sharing Online moves text from one device to another through your browser. Open this page on two devices — say your phone and your laptop — type the same password on both, and whatever you push on one appears on the other. No app to install, no account, no emailing yourself.
The text is encrypted on the device you send it from and decrypted on the device that receives it. In between, our server holds only ciphertext it has no key for, and deletes it within minutes: 10 by default, an hour at most.
It is built for the small, constant friction of owning more than one device: the link on your phone you want on your monitor, the snippet on your work laptop you need on your own.
How it works
- Create a room. On the first device, type a password (or let the app generate one) and press Create room.
- Join from the other device. Open this site there, type the same password and press Join room. Easier still: on the first device use Share link or Show QR — opening the link or scanning the code joins the room automatically, with the password carried in the part of the link after
#, which browsers never send to a server. - Type or paste. Put your text in the room's editor and press Push.
- It appears on the other device. By default it arrives instantly; in Manual rooms the other side presses Pull. Copy it and you're done — the room expires on its own.
Why this is different from other online clipboards
Almost every online clipboard says it is “encrypted”. Usually that means TLS — the padlock in your address bar — which protects your text on its way to their server. When it arrives, their server decrypts it and stores or relays it in a form they can read. That is encryption in transit: you are trusting the operator, their logs, their staff and anyone who ever breaches them.
Here the text is encrypted before it leaves your device, with a key the server never receives. Our server holds ciphertext it is mathematically unable to decrypt — not because of a policy, but because it never has the key. Concretely, and all of it checkable in the source:
- Your password is stretched with Argon2id (64 MiB of memory, 3 passes) in your browser, so every password guess costs real memory and time.
- HKDF splits the result into two independent values: an opaque room id — the only thing sent to the server, to find your room — and an AES-GCM-256 content key that never leaves the browser. Your password never leaves it either.
- Every push is encrypted with a fresh random 96-bit nonce. GCM is authenticated: if anyone, us included, tampered with the stored ciphertext, decryption would fail rather than show you altered text.
- The server stores only the room id, the ciphertext, its nonce, timestamps and a few room settings. Devices prove membership with a random token that the server keeps only as a SHA-256 hash.
- Private rooms seal when full, so a password that leaks later can't get in, and every room auto-expires — 10 minutes by default, 1 hour at most.
- The code is open source, and a strict Content-Security-Policy lets the page connect only to our own origin (the API and its live-sync WebSocket) and to Cloudflare Web Analytics, a cookieless page-view beacon — no other third party.
The honest caveat. Two devices meet on the password alone, so key derivation uses a fixed, public salt rather than a random per-user one. Someone who stole the database could therefore guess passwords offline, and each guess is tested against every room at once. Argon2id makes every guess expensive and rooms vanish within an hour, but a weak password is still the biggest risk — which is why the app refuses weak passwords and can generate a random one. The security page covers the full threat model.
Use cases
A URL from your phone to your laptop
You found the article on your phone; you want to read it on the big screen. Paste, push, open.
A 2FA backup code
Move a recovery code between devices without it sitting in your email, chat history or a cloud note.
An address
Send the delivery or meeting address from your desktop to the phone that's about to open the maps app.
A long command onto a remote box
Open the page in the remote machine's browser and paste a long command or config snippet instead of retyping it.
Text off a work machine
Get a snippet from a locked-down work laptop to your own device with nothing to install and no account to sign in to.
A Wi-Fi password for a guest
Show the room's QR code and the long Wi-Fi key lands on their phone — no spelling it out character by character.
Moving text between a phone and a computer? Here's the quickest way.
Frequently asked questions
Is it really end-to-end encrypted? What does that mean here?
Yes. Your text is encrypted with AES-GCM-256 inside your browser before any network request, using a key derived from your password on your own device. Only the other devices that know the password can derive the same key and decrypt it. Everything in between — the network, our server, our database — only ever handles ciphertext.
Can you, the operator, read my text?
No. The server receives an opaque room id, the ciphertext and its random nonce — never the password or any key — so there is nothing on our side that can decrypt it. The one caveat is that you are trusting the JavaScript this site serves you to do what it says; the code is open source so you can check it, and your browser's Network tab shows exactly what leaves the page.
How long is my text stored?
Briefly. By default a room expires 10 minutes after it was created or last pushed to; the room creator can pick 1 minute or 1 hour instead, and the server caps it at 1 hour. Expired rooms are deleted when next read and by a cleanup job that runs every 5 minutes, and the room creator can delete the room and its content at any time with Remove room.
What happens if I lose the password?
The text is gone for you — there is no reset, recovery or backup, because we never had the password or the key. Just create a new room with a new password. Since rooms expire within an hour at most, very little is ever lost.
Can I share files or images?
No. It is text only: anything you can type or paste as text, up to 256 KB of encrypted data per push. There is no file or image upload.
How many devices can join a room?
Two by default. The room creator can allow up to 6 devices, or make an open room with no limit, under Advanced Settings.
What is a private (sealed) room?
A private room stops accepting new devices the moment it is full, and it stays sealed for the rest of its life — even if someone later learns the password, they cannot get in. Removing a device does not reopen its slot. Because your place in the room lives only in the open tab, a reload or a closed tab uses up a slot, so keep the tab open.
Do I need an account?
No. There is no sign-up, no email and no login. The shared password is the only thing two devices need to find each other.
Does it work between an iPhone and a Windows PC?
Yes. It runs in any modern browser, so iPhone, iPad, Android, Windows, macOS and Linux can all share the same room. There is nothing to install on either side.
What if two people pick the same password?
They end up at the same room — this is the honest trade-off of a password-only design. The room and its key are derived from the password alone, so anyone who types the same password while the room exists can join it (unless it is already sealed) and read what is pushed to it. That is why the app blocks weak passwords, offers random ones, and seals private rooms when full; if Create says a room already exists for your password, someone else is using it, so pick a different one.
Open source — check it yourself
Don't take our word for any of this. Every line of the app, the API and the encryption is public: read it, run it, and open your browser's Network tab to see that nothing leaves the page but an opaque room id, ciphertext, its nonce, a membership token and a few room settings — plus Cloudflare's page-view beacon.