Flashpaper – Zero-Knowledge Ephemeral Secret Sharing

TL;DR

TL;DR: Flashpaper is an open-source ephemeral secret-sharing tool that stores everything in RAM, encrypts client-side with AES-256-GCM, and permanently deletes content after a single read — free for individuals, $49/month per brand for hosted white-label.

Source and Accuracy Notes

⚠️ This section is MANDATORY. All links must be verified from actual source, not guessed.

• Project page: flashpaper.app
• Source repository: github.com/mmmpym/flashpaper — MIT license, README confirmed
• HN launch thread: news.ycombinator.com/item?id=41192654 (25 points, 2026-07-28)
• Developer docs: flashpaper.app/developers

What Is Flashpaper?

Flashpaper is a zero-database, self-destructing secret sharing application. Notes and files up to 10MB are encrypted client-side before transmission, stored exclusively in server RAM, and permanently deleted after a single read. The server never holds plaintext — the encryption key travels in the URL fragment (#key), which browsers never send in HTTP requests.

The project launched on Show HN in July 2026 with 25 points. It is MIT-licensed, self-hostable via Docker or Node.js, and includes an MCP server endpoint and REST API for AI agent integrations.

Setup Workflow

Step 1: Prerequisites

• Docker and Docker Compose (recommended), or Node.js 18+ for manual deployment
• 512MB RAM minimum

Step 2: Clone and Configure

git clone https://github.com/mmmpym/flashpaper.git
cd flashpaper
cp .env.example .env

Edit .env as needed. The only variables that matter for basic self-hosting are APP_URL (set it to your public URL so MCP and OpenAPI links resolve correctly) and AGENT_API_KEYS (comma-separated keys that grant AI agents higher rate limits of 100 creations per 15 minutes).

Step 3: Launch with Docker

docker compose up

The app becomes available at http://localhost:3000. For production, point APP_URL to your public domain and run behind a reverse proxy with TLS.

Step 4: Verify the Deployment

Flashpaper’s README includes a verification procedure to confirm your self-hosted instance has not been modified to log secrets:

1. Open the browser’s Developer Tools (F12) and navigate to the Sources or Network tab.
2. Inspect the bundled JavaScript files under /assets/.
3. Confirm that encryption runs via the native crypto.subtle Web Crypto API and that raw keys appear only in the URL fragment (#key).
4. Compare local build hashes from npm run build against your deployed asset hashes.

Developer & AI Agent Integration

Flashpaper ships with first-class developer endpoints:

• OpenAPI 3.0 spec: GET /openapi.json
• MCP server: POST /api/mcp
• LLM context index: GET /llms.txt
• Agent REST endpoint: POST /api/agent/vault — takes agentName and agentPurpose tags; returns a vault ID and decryption key to be delivered over separate channels

Example Agent API Call

curl -X POST https://flashpaper.app/api/agent/vault \
  -H "Content-Type: application/json" \
  -d '{
    "agentName": "cursor-rule-engine",
    "agentPurpose": "deliver-api-key-to-owner",
    "content": "sk-abc123secretkeyvalue"
  }'

The response returns a one-time vault URL and a separate decryption key — send them over different channels (e.g., vault ID via Slack, key via email) to preserve the split-delivery guarantee.

Security Model

• Client-side AES-256-GCM encryption — server never sees plaintext
• RAM-only storage — no disk, no database; a server restart wipes all unread secrets immediately
• One-time read — each vault permanently burns after first decryption attempt
• Spotlight Lens — browser-side optical mask that blurs everything except the focused cursor area, blocking full-screen screenshots and OCR screen grabbers
• Zero-knowledge architecture — verification procedure in the README lets you confirm the deployed code matches the open-source build

Deployment constraints: When hosting on Google Cloud Run, AWS Fargate, or Kubernetes, configure min-instances=1 and max-instances=1. Scale-to-zero cold starts and multi-instance state splits would break the one-time-read guarantee.

Pricing

• Free for individuals, open-source projects, and small teams
• $49/month per brand — white-label portal with custom domain on the hosted service
• From $990/year — enterprise self-host license with priority support

Contact: [email protected]

FAQ

Q: What happens if the server restarts with unread secrets? A: All unread vaults are flushed immediately. The architecture requires the server process to stay alive between creation and read.

Q: Can I self-host Flashpaper without Docker? A: Yes. Run npm install && npm run dev for development or npm run build && npm start for a production Node.js server.

Q: Does Flashpaper work with AI agents like Cursor or Claude Desktop? A: Yes. It ships an MCP server endpoint at /api/mcp and a REST API at POST /api/agent/vault designed for agent integrations. The agent endpoint accepts agentName and agentPurpose tagging.

Q: What is the file size limit? A: The hosted service at flashpaper.app supports files up to 10MB. Self-hosted instances have no built-in limit but are constrained by available RAM.

Conclusion

Flashpaper solves a narrow, real problem: sending secrets that leave no trace. Its zero-knowledge architecture, RAM-only storage model, and MIT license make it a strong choice for developers who want auditability and self-hosting control over services like PrivNote or OneTime Secret. The included MCP server and REST API also make it natural infrastructure for AI agent workflows that handle credentials, API keys, or other sensitive one-time payloads.