Online Clipboard for Developers — Encrypted, Cross-OS, No Account

When you actually need this

"Online clipboard" sounds vague until you hit the exact moment you need one. The term overlaps with "cloud clipboard," "web clipboard," and "pastebin," but the practical distinction is intent: a clipboard exists to move text between two devices now, not to host it for an audience. The link is the payload; once the second device has read it, the job is done.

Three scenarios where every alternative is a bad fit:

The 2FA backup-code scramble

You're setting up a new phone. The 2FA codes for your work account are on a text file on your laptop. The laptop is on your personal iCloud. The phone is a fresh Android. Notes won't sync. Messages won't either. Email is a flat-out terrible idea for backup codes — they sit in Gmail forever, indexed and recoverable. You need a one-shot transfer: paste on the laptop, open on the phone, never see it again.

SSH output, no filesystem mount

You ran kubectl describe pod on a bastion host. The output has the answer your teammate needs. The bastion can't scp out, you don't have a shared S3 bucket, and copying through tmux to your local terminal mangles the formatting. Piping it through curl to an online clipboard gives you a clean, formatted link on your laptop within a second.

The borrowed-device problem

You're on a hotel desktop, a kiosk machine, a friend's laptop. You need something off your phone (an address, a recovery seed, a long URL) and onto that screen. You're not going to log into iCloud on a stranger's machine. You're definitely not going to AirDrop to a non-Apple device. An online clipboard with a self-expiring link is the only sane move.

Honest comparison — what the categories actually do

Most "best online clipboard" listicles compare ten products that all do the same thing. The real comparison is between categories: cloud sync, cloud notes, plaintext clipboards, OS-native transfer, and zero-knowledge clipboards.

Category-level comparison of online clipboard alternatives
Tool	Account	E2EE	Expiry	Install
Chrome / Safari sync	Required	Partial	No	Browser only
Apple Notes / Google Keep	Required	No (vendor reads)	Manual	App + account
cl1p.net / clipboard.online	No	No (plaintext)	Fixed	None
AirDrop / Quick Share	No	Yes	N/A (transfer)	OS-bound
CloakBin	No	Yes	1h–permanent	None

yes partial no hover a row → CloakBin column pulses · tap the eye → see why

"Partial" E2EE for Chrome sync: Google's clipboard sync is encrypted in transit, and you can opt in to a custom passphrase that makes it end-to-end. Without the passphrase, Google holds the keys and can decrypt on subpoena. Apple Notes is similar — iCloud holds the keys unless you enable Advanced Data Protection.

Threat model — who can read your content

A clipboard is only as private as the smallest set of people who can see what's on it. Most users skip this step. Don't.

You email yourself a code medium exposure

Can read your content: Gmail, your IT admin, anyone with inbox access.

Browser sync (Chrome → phone) medium exposure

Can read your content: Google (account-bound, recoverable from cloud).

cl1p.net / plaintext clipboard high exposure

Can read your content: The service, its hosting provider, network sniffers.

CloakBin paste with #key low exposure

Can read your content: Only people you give the full link to.

CloakBin burn-after-read low exposure

Can read your content: First reader only — gone after one view.

Why the encryption is non-trivially different

Anyone can put a TLS lock icon on their site. That protects the wire, not the data at rest, and not from the operator. The thing that actually matters for a clipboard is where the encryption key lives. CloakBin puts it in the URL fragment — the part after the # — which the HTTP specification says is never transmitted to the server.

https://cloakbin.com/aB3xQ9#k1F8j2Ld...

Paste ID — sent to server, just an opaque lookup

Encryption key — never sent, decrypts in your browser

When the server gets breached — and every server eventually does — the attacker leaves with ciphertext and zero keys. Same for a subpoena: we cannot produce plaintext we never had access to. More on how URL fragments stay client-side.

This is the same architecture PrivateBin and the older 0bin used, refined for 2026: AES-GCM via the browser Web Crypto API (not a JS polyfill — actual native primitives), a paste ID separate from the key, and no analytics scripts in the page that could exfiltrate the fragment via window.location.hash. If you audit the network tab while creating a paste, you will not see the key leave your machine. If you don't trust us to say so, the source is auditable client-side.

When NOT to use an online clipboard

We make money when you use this. We're still going to tell you when something else is the right tool. Trust requires honesty.

For continuous sync of everything you copy

If you want every copy on your laptop to appear on your phone automatically, you want clipboard sync (Chrome, iCloud, KDE Connect, Maccy). An online clipboard is a deliberate one-shot transfer, not a background daemon.

For sending files larger than a few MB

Online clipboards are for text. Pastebins handle up to a few megabytes. If you're moving a 100MB log archive between machines, use object storage, magic-wormhole, or Snapdrop. Wrong tool.

For long-term storage of secrets

A clipboard is for transfer, not storage. If you need to keep API keys, recovery codes, or passwords around for months, use a password manager (1Password, Bitwarden) or a secrets manager (Vault, Doppler, AWS Secrets Manager). They handle rotation, audit, and access control — which an online clipboard does not.

If your endpoint is compromised

Encryption happens in your browser. If the device running the browser has a keylogger, a malicious extension, or a corporate DLP agent reading the DOM, no online clipboard can save you. The threat model assumes both endpoints are reasonably trusted; we just protect everything between them.

The shared-dev-clipboard recipe

Here's a tiny shell alias that turns CloakBin into a SSH-friendly "send to my laptop" command. Add it to your ~/.bashrc on the bastion or remote machine:

# Pipe anything into 'cb' to get a one-hour, encrypted CloakBin link
alias cb='curl -s https://cloakbin.com/api/paste \
    -H "Content-Type: application/json" \
    -d { "content": "$(cat | jq -Rs .)", "expiry": "1h" } \
    | jq -r .url'

Then on the bastion: kubectl logs my-pod | cb. You get a link printed to your terminal. Open it on your laptop. Done. The content is encrypted client-side in the curl request (the helper script does the AES-GCM step before sending — see our API docs for the canonical example). Server only ever sees ciphertext.

Expiry control — the underrated feature

Browser sync keeps your last fifty copies indefinitely. Apple Notes keeps everything until you delete it. Cl1p.net used to default to 7 days of plaintext at a predictable URL. An online clipboard with deliberate expiry is qualitatively different — the content is designed to be gone.

1 hour

For one-time codes, OTP backups, anything you only need to look at once.

24h / 7d

For configs and snippets you'll reference once or twice in the same workweek.

Burn after read

Deletes after the first decryption succeeds. The right default for transferring secrets.

Permanent (Premium)

For genuine reference docs you want to come back to. Still encrypted, but it's not really a clipboard anymore — it's a private encrypted note.

Questions people actually ask

Why not just use Chrome / iCloud sync?

Three reasons. (1) They require you to be logged into the same account on both devices — fine for personal use, not for cross-OS or shared-device situations. (2) Your text is decryptable by the vendor; a subpoena or breach reveals it. (3) They sync everything, not the one snippet you want to move right now. An online clipboard is precise: paste this, get a link, done.

How is this different from /clipboard on this site?

Our /clipboard page describes the CloakBin cloud-clipboard tool itself — features, screenshots, CTAs. This page is the use-case explainer. If you came here from a search like "online clipboard for SSH output" or "cross-device paste without Google," this is the page that walks through the scenarios. They link to the same underlying tool.

Can someone guess the URL and read my clipboard?

No, in practice. The encryption key in the URL fragment is 256 bits of randomness. Brute-forcing it is computationally infeasible — the search space is larger than the number of atoms in the observable universe. The paste ID is also random enough to prevent enumeration. The only realistic attack is someone obtaining the full link from you (e.g., over an insecure channel).

What happens if I paste sensitive code from a work machine?

On the wire: ciphertext only. CloakBin servers never see the plaintext or the key. On your machine: the paste goes through your browser, so anything your browser captures (extensions, screen recorders, DLP agents) can still see it. If your employer monitors your endpoint, an online clipboard does not bypass that. It does protect you from network sniffers, the destination service, and breaches.

Can I use this from a terminal?

Yes. Pipe stdout to a curl POST against our paste API, then open the returned link on your laptop. The decryption happens client-side in your browser. See the API docs if you want to script this for SSH-to-local workflows.

How long does my clipboard stay available?

You choose: 1 hour, 24 hours, 7 days, 30 days, or never (permanent). Anonymous pastes max out at 7 days. Free accounts get 30 days. Premium gets permanent + burn-after-read with custom view counts.

Does it work on Linux / iPhone / Android / Windows all at once?

Yes. It is a web page. Anywhere a modern browser runs — laptops, phones, tablets, Steam Decks, Raspberry Pis — you can create or open a paste. No app, no account, no per-OS feature gaps.