Your mom needs your passport number for a flight booking. You text it. That number now lives in her phone, her cloud backup, your backup, and maybe a carrier log. It could sit there for years.

There is a better way. Send a link that works once, then vanishes.

The scenario

You want to share a secret with someone. It might be an ID number, a Wi-Fi password, or a bank detail. You want three things:

  • It can't be read by the server holding it
  • It deletes itself after one view
  • No account needed on either end

The tool is PrivateBin. It's free, open source, and tiny.

Why PrivateBin is different

Your browser encrypts the note before it leaves your device. The decryption key lives after the # in the link. Browsers never send that part to the server. So even your own server only stores scrambled text. If someone steals the disk, they get nothing useful.

Step 1: Start it with Docker

Make a folder, then fix its permissions so the container can write to it:

mkdir privatebin && cd privatebin
mkdir data && sudo chown 65534:82 data

Create docker-compose.yml:

services:
  privatebin:
    image: privatebin/nginx-fpm-alpine
    container_name: privatebin
    ports:
      - "8080:8080"
    volumes:
      - ./data:/srv/data
    restart: unless-stopped

Run docker compose up -d. Open http://localhost:8080. You should see a plain text box.

Step 2: Put it behind HTTPS

The in-browser encryption only works on a secure connection. Localhost is fine for testing. For real use, you need HTTPS. Pick one:

  • Easiest: Use Tailscale and enable its HTTPS certificates. Only your devices can reach it.
  • Public: Point a domain at your server and use Caddy. It fetches certificates for you.

If family members aren't on Tailscale, go public. The encryption still protects the content.

Step 3: Send your first secret

  1. Paste the passport number into the box.
  2. Tick Burn after reading.
  3. Set expiry to 1 day as a backup.
  4. Add a password if you're extra careful. Share the password by phone call.
  5. Click Send and copy the link.

Text the link. Mom opens it, copies the number, and the note is gone. If someone scrolls her messages next year, they hit a dead link.

Step 4: Check that it really burned

Open the same link yourself after she reads it. You should see an error saying the paste doesn't exist. That's the proof it worked.

One habit to avoid

Don't open the link yourself to "test it" before sending. Burn-after-reading means you just burned it. Use the preview on the send screen instead.

Your takeaway

Tonight, search your messages for "password" or your ID number. Count the hits. Then spin up PrivateBin and make that the last secret you ever send in plain text.