FlashPaper does one thing: it takes a secret — a password, a set of credentials, an access token, a snippet of source code — encrypts it, and hands back a URL that works exactly once. The recipient opens it, confirms they want to read it, and the message is destroyed. There are no accounts, no dashboard and no database server to provision: a single PHP application with a SQLite file is the whole install, which is why it fits on the smallest VPS or behind a home reverse proxy.

What happens to a secret

• A random 256-bit AES key and a random IV are generated for each secret, and a random 64-bit ID is hashed together with that key using bcrypt.
• The submitted text is encrypted with AES-256-CBC, then encrypted again with a static 256-bit key held on the server, so a stolen copy of the database is not enough to read anything.
• The retrieval link carries the ID and the per-secret key. On first open the row is looked up, verified against the bcrypt hash, decrypted and deleted. A second visit reports “This message has been destroyed”.
• Retrieval asks “View this secret?” before destroying anything, so a chat link preview or a mail scanner that fetches the URL does not burn the message before the human clicks it.
• Secrets that are never retrieved are pruned when the page loads: each is given a random expiry between min_days and max_days (365 and 730 days by default) so abandoned entries do not pile up.

Running it

• Docker is the recommended route: the image is ghcr.io/andrewpaglusch/flashpaper, and the documented compose file mounts one volume at ./data for the SQLite database and the static AES key.
• A traditional install needs only PHP 7.0+ on a web server: copy settings.example.php to settings.php and edit it. The README also suggests disabling access logging, so IP addresses, user agents and timestamps are not written to disk.
• Everything visible is configurable — site title and logo, an announcement banner, every on-page string, and max_secret_length (3000 characters by default).
• base_url fixes the generated retrieval URL when FlashPaper sits behind a reverse proxy on a sub-path.
• The interface follows the browser’s light or dark preference, with a manual toggle in the corner.

Templates and the API

• The editor offers templates — Credentials and Credit Card are built in — that prefill the form with the right shape of text. They are plain files in templates/, so an operator can add their own.
• Secrets can be submitted from a script: a POST with json=true returns the one-time link as JSON, which makes it usable from a CLI, a deploy job or a chat bot.

Alternatives

• PrivateBin — encrypted pastes with burn-after-reading and a broader pastebin feature set
• MicroBin — Rust pastebin with one-time and expiring pastes
• rustypaste — minimalist single-file upload server with expiry