Co-Pas Documentation

Overview

Co-Pas is a privacy-first service for sharing temporary text and files without creating an account.

Content is encrypted in your browser before it is uploaded. Co-Pas receives only encrypted data and does not receive the decryption key required to read it.

Key features

How It Works

Creating a text paste

1. Enter or paste text into the Co-Pas editor.
2. Choose an expiration time.
3. Optionally enable password protection.
4. Co-Pas encrypts the text inside your browser.
5. Only encrypted data is sent to temporary storage.
6. Co-Pas generates a share link containing the information needed to decrypt the paste.
7. Send the complete link to the intended recipient.

Opening a text paste

1. The recipient opens the complete Co-Pas link.
2. The browser retrieves the encrypted paste.
3. The decryption key is read locally from the URL fragment.
4. Decryption takes place inside the recipient's browser.
5. The readable content is displayed only after authenticated decryption succeeds.

Why the key appears after #

A Co-Pas link looks similar to this:

The section after # is the URL fragment. Browsers do not include URL fragments in normal HTTP requests, so the decryption key is handled locally by the browser instead of being sent to Co-Pas.

Text Sharing

Text pastes support up to 50,000 characters. They are suitable for temporarily sharing notes, code snippets, configuration, logs, JSON, Markdown, command-line instructions, and other plain-text information.

Code-like content may be displayed with syntax highlighting. Syntax highlighting changes only how the text is displayed — it does not execute the submitted content.

Available options

• Time-based expiration — content expires automatically after the selected duration.
• Burn after reading — content is consumed on first retrieval.
• Password protection — require a password to decrypt the paste.
• QR code — generate a scannable QR code for the share link.
• Copy to clipboard — copy the share link with one click.
• Syntax highlighting — automatic language detection for code pastes.

File Sharing

Co-Pas supports temporary encrypted file sharing for files up to 5 MiB.

Creating a file share

1. Select or drop one file into the upload area.
2. Choose an expiration time.
3. Optionally enable burn after retrieval.
4. Co-Pas may compress the file locally when lossless compression provides a meaningful size reduction.
5. The file and its private metadata are encrypted in your browser.
6. Only encrypted file data is uploaded.
7. Co-Pas generates a temporary share link.
8. Send the complete link to the recipient.

Private metadata — including original filename, file type, original size, and compression method — is encrypted before storage.

Retrieving a shared file

1. The recipient opens the complete file link.
2. The browser decrypts the file metadata locally.
3. Co-Pas displays the filename, size, and expiration status.
4. The recipient selects Retrieve & Download.
5. The encrypted file is downloaded and decrypted in the browser.
6. If lossless compression was used, the browser restores the original file.
7. The original file is saved to the recipient's device.

Lossless compression

When supported and beneficial, Co-Pas may compress a file before encryption. This process does not intentionally remove quality or change the original file format. After successful decryption and decompression, the resulting file matches the original data. Files that are already efficiently compressed may be encrypted without additional compression.

Expiration & Burn After Reading

All Co-Pas content is temporary. Available expiration options include:

Option	Available for
10 minutes	Text & Files
15 minutes	Text only
30 minutes	Text only
1 hour	Text & Files
1 day	Text & Files
Burn after reading	Text & Files

Time-based expiration

Time-based content remains available until its expiration time is reached. After expiration, the content can no longer be retrieved, the decryption key cannot restore deleted data, and Co-Pas cannot recover the content.

Burn after reading

The encrypted content is atomically consumed on its first retrieval attempt. One-time content may become unavailable if the shared link is incomplete, the decryption key is incorrect, the browser closes during retrieval, or the network connection fails.

Password Protection

Text pastes may be protected with an optional password.

Without a password

Co-Pas generates a random encryption key in the browser. The key is included in the URL fragment of the generated link. Anyone with the complete link may be able to decrypt the paste.

With a password

The encryption key is derived locally from the password and a random salt. The password itself is not transmitted to Co-Pas. The recipient must provide the correct password before the browser can decrypt the paste. An incorrect password causes authenticated decryption to fail.

Recommendations

• Use a long, unique passphrase rather than a short password.
• Send the Co-Pas link through one communication channel.
• Send the password through a different channel.
• Do not include the password in the same message as the link.

Security & Privacy

Browser-side encryption

Co-Pas uses authenticated encryption in the browser. Authenticated encryption protects both confidentiality and integrity — content cannot be read without the correct key, and modified or corrupted ciphertext will fail decryption.

What Co-Pas does not receive

• Plaintext text content
• Plaintext file contents
• Decryption keys
• Passwords used for paste encryption
• Plaintext private file metadata

What Co-Pas processes

To operate the service, Co-Pas processes the minimum technical information required to store encrypted content temporarily, apply expiration, enforce one-time retrieval, validate file size, prevent abuse, and diagnose service failures. Co-Pas does not use this information to create user accounts, advertising profiles, or a permanent transfer history.

Privacy

• No account required — no email address, name, or login.
• No advertising scripts, tracking pixels, or third-party profiling cookies.
• Co-Pas does not build behavioral profiles for advertising purposes.
• Limited technical information may be processed temporarily for security, rate limiting, and service operation.

Security Limitations

Co-Pas is designed to protect content from being readable in temporary server-side storage. It does not protect against every possible threat.

Co-Pas helps protect against

• Plaintext exposure from temporary storage access
• Accidental long-term retention
• Unauthorized decryption without the complete link or password
• Silent modification of encrypted content
• Concurrent retrieval of one-time content

Co-Pas cannot protect against

• A compromised device — if the sender's or recipient's device is compromised, malicious software may access content before encryption or after decryption.
• A stolen complete link — for an unprotected paste, possession of the complete link acts as authorization.
• A weak password — short or common passwords may be vulnerable to offline guessing.
• Recipient actions — after content has been decrypted, Co-Pas cannot prevent the recipient from copying, saving, screenshotting, or sharing it.
• Malicious encrypted files — Co-Pas cannot inspect encrypted file contents. The recipient is responsible for deciding whether to trust a downloaded file.
• Lost keys — a lost, incomplete, or modified share link may make the content permanently inaccessible.

Responsible Use

Do not use Co-Pas to distribute malware, circumvent security controls, conduct phishing or fraud, harass or threaten others, share content without permission, violate applicable law, or attempt to disrupt Co-Pas or its infrastructure.

Co-Pas should not be treated as a substitute for a password manager, a dedicated secrets manager, an encrypted backup system, permanent cloud storage, a regulated document-management service, or a malware scanning service.

Frequently Asked Questions

Can Co-Pas read my content?

Co-Pas is designed so that encryption takes place in the browser and the decryption key is not sent to the service. Co-Pas stores encrypted data and the minimum operational metadata required to deliver and expire it.

What happens if I lose the complete link?

Co-Pas cannot recover the decryption key. If the complete link is lost, the encrypted content may become permanently inaccessible.

Can expired content be recovered?

No. Once the encrypted content has been removed, the link and decryption key cannot restore it.

When is burn-after-reading content consumed?

It is consumed on its first retrieval attempt — not after successful browser decryption. An incomplete link, incorrect key, interrupted connection, or browser error may therefore make one-time content unavailable before the recipient sees it.

Can the first recipient copy burn-after-reading content?

Yes. Burn after reading prevents a second retrieval from Co-Pas. It cannot stop the first recipient from copying or saving content after decryption.

Does Co-Pas require JavaScript?

Yes. Encryption and decryption happen inside the browser using JavaScript. A server-side fallback would break the privacy model by exposing plaintext to the server.

Can Co-Pas inspect an encrypted file for malware?

No. File contents are encrypted before upload. Only download files from trusted sources.

Does file compression reduce quality?

No. Co-Pas uses only lossless compression when it provides a meaningful reduction. No quality loss or format conversion is performed. If compression is not beneficial, the original file bytes are encrypted directly.

Which browsers are supported?

Co-Pas requires a modern browser with Web Crypto API support. If an optional capability is unavailable, Co-Pas will use a safe fallback where supported.

Is Co-Pas completely anonymous?

No web service can promise complete anonymity. Co-Pas does not require an account and does not intentionally build permanent user profiles, but network infrastructure may process technical information such as IP addresses and request metadata.

Responsible Disclosure

If you discover a security vulnerability in Co-Pas, please report it privately through the contact channel provided on the website.

A useful report includes

• A clear description of the issue
• Steps to reproduce it
• The affected route or feature
• The potential security impact
• Supporting screenshots or request details

Please avoid

• Accessing content that does not belong to you
• Disrupting service availability
• Publishing an unresolved vulnerability
• Retaining or distributing sensitive data discovered during testing