Security guides
Burn after reading: when a one-time link helps and when it backfires
A one-time link is strict by design. Use it when the recipient is ready and the cost of a failed open is lower than the cost of a second copy.
Updated · 2 min · Free, no account required
Burn after reading deletes a paste on the first successful open. It is the closest thing to a guaranteed one-read handoff, and it is easy to misuse.
Time: 2 minutes · Cost: free · Account: not required
Step by step
-
1
Decide whether one read is enough
If the recipient may need to copy several values, check a detail twice or open the link on another device, a short expiry is safer than a forced one-read.
-
2
Create the paste and enable burn after reading
Add the text, choose a short expiry as a fallback, and tick the burn option. The expiry still applies if the link is never opened.
-
3
Make sure the recipient is ready
Send a message asking them to confirm they are at the device where they will use the secret. Do not send the link into a channel that nobody is watching.
-
4
Send the password through another channel
If the paste is password protected, send the password separately. The recipient should have both halves before the first open.
-
5
Open once and copy what you need
The first successful open deletes the paste. Copy the values into the place they are needed before closing the tab.
-
6
Use the manage link if the handoff fails
If the wrong person opened it or the recipient opened it by mistake, create a new paste. The original cannot be recovered, which is the point.
When a one-time link is the right choice
Use it for a recovery code, a temporary password, a single invite token or a handoff where the recipient is known to be ready. The value is that a forwarded link does not provide a second opportunity to read the content.
It is also useful when the sender wants a clear, auditable statement: this content was designed to be consumed once.
When it backfires
A recipient who opens the link in the wrong browser, loses the tab or needs to check a detail has no second chance. In a support or onboarding flow, that creates friction and encourages people to send the secret through a worse channel.
For a multi-line configuration or a set of instructions, use a short expiry instead. The expiry still removes the content without making a single mistake fatal.
What happens technically
PasteOkay compares the expiry on every read. When burn after reading is enabled, the first successful open deletes the row, so a second request receives a not-found response rather than another copy. The manage link still works for deletion, but the content cannot be recovered.
Frequently asked questions
Does burn after reading delete the paste immediately?
It deletes the row on the first successful open. A second request receives a not-found response instead of the text.
Can I recover a paste after it was burned?
No. The content is removed and cannot be recovered. Create a new paste if the handoff needs to happen again.
Is burn after reading better than an expiry?
They solve different problems. Burn is stricter for a one-read handoff; an expiry is more forgiving for a short window with several reads.
Can I use both?
Yes. Set a short expiry as a fallback and enable burn after reading. The paste disappears at the first read or at the expiry, whichever comes first.
Related reading
Share a password safely
A step-by-step method for sending a password or credential so it expires, can be read once, and never sits in a mailbox or chat history.
Read morePasteOkay vs Yopass
Yopass is an open-source service for one-time secrets. We compare its one-read model, expiry, self-hosting and interface with PasteOkay.
Read morePasteOkay vs OneTimeSecret
OneTimeSecret shares a secret through a link that self-destructs after reading. We compare its passphrase model, expiry and text handling with PasteOkay.
Read morePut the guide into practice
Create a paste, choose a short expiry and add a password. No account, no public feed and no third party scripts.