Cross-machine clipboard

Ctrl+C here. Ctrl+V there.

An end-to-end encrypted scratchpad for people juggling VMs, RDP sessions, SSH boxes, Azure Bastion tabs, and locked-down admin desktops. Pair a password with a 5-character code and move anything from one side to the other — text, screenshots, logs, config snippets, files, video. Real-time sync in under 100 ms over WebSocket. A plain gpg + curl path helps when direct scp, sftp, or clipboard sync is blocked or annoying. The server only ever sees ciphertext.

How it works

Three steps. That's the whole protocol.

  1. 01

    Pick a password

    It stays in your browser. PBKDF2-SHA256 derives the session key locally; nothing crosses the wire until it's already AES-256-GCM ciphertext.

  2. 02

    Get a 5-char code

    A fresh pad is reserved in memory on the server. Hand the code to your other machine through whatever channel you trust.

  3. 03

    Paste anything

    Ctrl+V text or images. Drag files. Drop a video. Every other device in the same pad sees it live over a WebSocket.

What the server holds

Only ciphertext. Nothing else.

Zero-knowledge AES-256-GCM

Every paste is authenticated-encrypted in the browser. 12-byte IV per item, item id bound as additional data. The server only ever sees opaque ciphertext as it fans messages out.

PBKDF2-SHA256, 310k iters

Your password never leaves the tab. Only the salt crosses the wire, and security rests on the password plus the AEAD tag.

Text, images, files, video

Anything the clipboard and drag-and-drop accept. Previews render client-side after decryption, lazily per card.

Per-pad challenge on join

Each pad gets its own random 32-byte token at creation. The ciphertext goes to joiners in the challenge; the raw bytes stay private to the server. Joiners must decrypt with the right key and echo the bytes exactly. Knowing the 5-char code doesn't help — without the password, the echo can't be forged.

Server stores nothing

Your content lives in the browser tabs that hold the pad open. The server forwards ciphertext between peers and keeps only each pad's 5-char code, PBKDF2 salt, and its challenge token (ciphertext + private plaintext) — routing metadata, nothing else.

15-minute idle timeout

When the last device disconnects, a 15-minute timer starts. If nobody rejoins, the pad's routing metadata is discarded and the 5-char code becomes reusable.

GPG + curl over SSH

Every pad ships a gpg --symmetric --cipher-algo AES256 + curl -T recipe. Push a log file up, pull a screenshot down with curl | gpg --decrypt. Your password is the passphrase — the server sees only OpenPGP ciphertext.

Real-time WebSocket sync

Text crosses devices in well under 100 ms. Binary payloads are bandwidth-bound, not server-bound — the bytes flow straight through and never cache.

No account, no install

Pick a password, get a code, go. No sign-up, no email, no app. Works in any modern browser and on any box with gpg and curl — standard tools, nothing extra to install.

Public usage stats

Live pads, lifetime totals, and a 30-day activity graph are all open at /stats. No ips, no pad codes, no content in the log — just enum counts. Raw JSON at /api/stats.

What you'd use it for

A few of the places it pays off.

  • Move a file in or out of Azure Bastion without wiring up SFTP

    You're in an Azure Bastion session and just need a log bundle, a config file, or a screenshot on your local machine. Open the pad in the Bastion-side browser, then pull or push through the same code from your laptop or a terminal.

  • Copy a stack trace out of a production VM

    You're SSH'd into a box with no GUI. Paste the traceback into a pad from the CLI, Ctrl+V it into Slack or a bug tracker on your laptop.

  • Work around a jump host where scp is the wrong level of effort

    You do not need to reconfigure firewall rules, open SFTP, or mount a shared drive just to move one archive, cert, or env file through a Linux bastion or admin box.

  • Move a screenshot out of an RDP session

    Remote desktops love to eat your clipboard. Grab a screenshot on the remote, paste it into the pad, and it's instantly on your local machine ready for an email or ticket.

  • Pull a build artifact without scp

    CI runner pushes the .zip into the pad; your laptop pulls it down. No SSH keys to exchange, no file share to set up, no cloud account to log into.

  • Sync a config between two browsers

    Two machines, two tabs, one password. Paste JSON, env files, or a long URL on one side and it appears on the other in milliseconds.

  • Hand a file to a teammate for five minutes

    Pad is ephemeral. Share a password + code over Signal, paste the file, they download it, everyone walks away, the pad evicts itself.

  • Clip a video frame off your phone

    Open the pad on your phone's browser, paste from the share sheet, pick it up on your desktop a second later.

Guides & field notes

Practical ways teams use ctrlc-ctrlv in real admin workflows.

This is not just a generic web paste tool. It is useful in the awkward spaces between a browser, a terminal, a bastion host, and a desktop where normal file transfer is blocked, overkill, or unreliable.

Knowledge base

Azure Bastion file transfer without opening more doors than you need

When you are already inside Azure Bastion and just need to get a log, config, screenshot, or small archive in or out, ctrlc-ctrlv gives you a fast handoff path without turning the task into a full SFTP or shared-storage exercise. Open the pad in the Bastion-side browser, then pull from your local browser or a terminal with the CLI.

Field note

Linux jump boxes and prod VMs are great until you only need one file

Sometimes the problem is not how to automate a whole deployment. It is how to move one traceback, cert, JSON payload, or build artifact from a Linux shell to your workstation right now. The CLI path keeps that flow simple: join the same pad, authenticate with the password, and upload or download without setting up another transfer channel.

Operator story

Locked-down enterprise desktops often break the obvious clipboard path

VDIs, RDP hosts, secure admin workstations, and browser hardening policies regularly block clipboard sync or make it flaky. That is exactly where a browser tab plus a 5-character code helps: type or paste on one side, open the same pad on the other, and use the item-level CLI or manual-copy fallback when browser clipboard APIs are restricted.

Runbook pattern

Handing artifacts from CI, support sessions, and incident calls

During an incident, the fastest path matters more than the perfect path. Teams use pads to hand off support bundles, screenshots, exported traces, and temporary config patches between a shell, a browser, and another engineer. The pad stays ephemeral, the content stays encrypted, and the operator does not have to stop to wire up a heavier transfer mechanism.

Across teams

Useful beyond DevOps: places the same pad workflow shows up in other fields.

The pattern is simple: one machine has the thing, another machine needs the thing, and the normal transfer path is blocked, flaky, slow to set up, or too broad for a one-off handoff.

Support & help desk

Move screenshots, exported logs, and repro notes between a user session and a support workstation

Support teams often need one screenshot, one exported settings file, or one crash log out of a remote session right now. A temporary pad is lighter than asking the user to upload to another system or opening a broader shared folder path.

Security operations

Hand off indicators, snippets, and triage artifacts between a hardened browser and an analysis box

SOC and IR work regularly happens across segmented tools and locked-down desktops. Pads are useful for moving a suspicious URL, a few hashes, a clipped event sample, or a small exported report without relying on email, chat paste limits, or unrestricted clipboard sync.

MSPs & consultants

Jump between client environments without building a custom transfer path for every engagement

Managed-service teams and consultants are constantly in different Bastion hosts, RDP sessions, tenant portals, and temporary admin desktops. A browser-first encrypted handoff flow is useful when every client has a different rule set and you still need to move a file or snippet in minutes, not hours.

QA & testing

Pull a failing screenshot, HAR file, fixture, or video capture off a test box quickly

Test environments are full of machines that are technically reachable but awkward to work with. When you only need the failing artifact, not a full automation pipeline, the pad gives testers a fast way to move evidence onto the machine where the bug ticket or analysis actually happens.

Labs & education

Share short-lived files between classroom VMs, browser sandboxes, and student laptops

In training labs and classroom environments, participants often need a simple way to move starter files, answers, logs, or screenshots between a lab VM and their own machine without teaching a whole separate transfer tool first.

Field service & operations

Collect device output or local config snapshots from awkward endpoints in the field

When a technician has one browser window, one remote session, and a local admin laptop, getting a config dump or diagnostic artifact off the target can be more important than building the perfect permanent workflow. A short-lived encrypted pad is often enough.

No black boxes

Right-click. View source.

The frontend is plain HTML, CSS, and ES-module JavaScript — no bundler, no minifier, no transpiler. What you read is what your browser runs. Every crypto call happens in files you can open in a new tab and read top to bottom.

  • /index.html The page itself. Same markup you're looking at now.
  • /js/crypto.js PBKDF2 + AES-256-GCM via WebCrypto. ~60 lines, nothing else.
  • /js/app.js UI controller: paste, drop, decrypt-per-card, peer replay.
  • /js/ws-client.js WebSocket with automatic HTTP long-poll fallback.
  • /js/gpg.js OpenPGP symmetric glue for the gpg + curl transfer path. Loads openpgp.js on demand.
  • /stats.html Public usage-stats page. Same header, same theme, same footer.
  • /js/stats.js Fetches /api/stats, renders the counters and the 30-day inline SVG chart.
  • /css/stats.css Layout for the stats page. Reuses theme tokens from the rest of the site.
  • /api/stats The raw aggregate JSON the stats page renders. Public, cached 10s, no PII.
Before you trust it

Frequently-asked, honestly answered.

Is the server reading my data?
No. Your password never leaves the browser. All payloads are AES-256-GCM ciphertext with random per-item IVs. The server can count bytes and see timestamps. That is the extent of it.
How fast is it?
Text pastes cross between devices in well under 100 ms on a decent connection; the server just fans WebSocket frames out. Files are bandwidth-bound, not server-bound: because nothing is stored, a 100 MB image arrives at the speed of the slowest link in the chain.
Do I need an account?
No. There is no sign-up, no email, and no identity of any kind. A pad is a 5-character code plus a shared password. Anyone who knows both can join; everyone else sees a password-challenge failure.
Can I transfer files from a Linux server over SSH?
Yes. Every pad has a GPG button that copies a two-line recipe: gpg --symmetric --cipher-algo AES256 file, then curl -T file.gpg host/g/<CODE>. A browser tab open in the pad decrypts the .gpg blob with the same password and re-emits it to the other peers — the server never sees plaintext. Every item card also has a one-shot /g/<TOKEN> pull link, so curl | gpg --decrypt works in the other direction too.
Is this useful for Azure Bastion or locked-down admin desktops?
Yes. That is one of the main reasons it exists. If normal clipboard sync, shared-drive access, scp, or sftp is blocked, flaky, or just excessive for the job, you can use the pad in a browser tab on the Bastion or desktop side and the same pad on your local machine or terminal. It works well for logs, screenshots, config snippets, support bundles, and one-off files that need to move quickly without opening a broader transfer path.
Who else is this useful for besides infrastructure engineers?
Support teams, SOC analysts, MSPs, QA engineers, lab instructors, consultants, and field-service operators all run into the same problem: two machines need to exchange one useful thing, but the built-in clipboard or file-transfer path is blocked, flaky, or too much ceremony. ctrlc-ctrlv is especially handy for screenshots, log files, traces, exported configs, and one-off artifacts that do not justify standing up a heavier handoff workflow.
What file sizes work?
The default per-item ceiling is 16 MB of ciphertext, which covers most screenshots, logs, short videos, and archives. The limit is configurable by the operator; the architecture itself is bandwidth-bound, not storage-bound.
What if someone tries to join my pad without knowing the password?
They cannot. Each pad has its own random 32-byte challenge token generated at creation: the ciphertext is shown to joiners, the expected plaintext is kept private server-side. A joiner has to derive the key from the password, decrypt the ciphertext, and echo the exact bytes back — the server compares in constant time. Knowing the 5-character code is not enough: without the password there is no way to produce the right echo. Get it wrong and the connection closes before a single paste is seen.
Where does the data live, and when does it die?
In your browser tabs, while they are open. The server holds only each pad's 5-character code, PBKDF2 salt, and its challenge token (ciphertext + the private plaintext used to verify joiners) — routing metadata, nothing else. When the last device disconnects, a 15-minute timer starts on that metadata; if nobody rejoins, the code becomes reusable. No pasted content is ever persisted anywhere.
Will my pastes survive a reload?
Only if another device is still in the pad at that moment. The first tab back asks existing peers to replay history. If every tab has closed there is nobody to replay from, so a rejoin with the same code shows an empty pad. Content lives in browser tabs, never on the server.
Can I audit the client code?
Yes — and you should. The frontend is plain HTML, CSS, and ES-module JavaScript served directly from the origin. Right-click → View page source on this page, or open the files below in a new tab. There is no bundler, no minifier, no transpiler: what you read is what your browser runs.
How is this different from pastebin?
Pastebin stores plaintext on the server and keeps it around. ctrlc-ctrlv encrypts in your browser, holds no ciphertext on the server at rest, and evicts a pad 15 minutes after everyone leaves. It is also bidirectional, real-time, and happy with binary files — not just text snippets.
Do you track users or keep analytics?
No tracking pixels, no cookies, no third-party scripts, no user accounts. The only thing we count is aggregate usage (how many pads got created today, how many pastes flowed through, ws vs polling split) — and even that is published openly at /stats with a raw JSON feed at /api/stats. The stats database holds small enum rows (kind, timestamp, optional byte count) — no ips, no pad codes, no item ids, no content. If the DB leaked you would learn the service load and nothing about any user.