Share a file.
It disappears.

Paste text Direct transfer

New The API, written down

Password (encrypts before upload)

Download limit

Expires after

Note

Delete after the first download Skip all server-side processing (needs a password)

Privacy Policy

What we store, what we don't, and for how long. Last updated November 2026.

How a file is protected

How much we can see depends on how the file is uploaded.

What we store for a file

The encrypted file
Its name, size and content type. The file name is stored readable in every mode, also for end-to-end encrypted files
Upload time, expiry, download limit, and counters for views and downloads
SHA-256 hashes of the file as received and as stored, for the blocklist and the transparency log
The result of the malware scan and of the file type check
The delete token, the note if you wrote one, and the password hash if a password was sent through the API
If you are logged in: a keyed hash of your Discord ID, so the file appears in your dashboard

Your IP address, in any form
Your password, or anything it could be derived from, for end-to-end encrypted files
Who downloaded the file

Malware scan and blocklist

Uploads are scanned with ClamAV, and a file can only be downloaded once its scan has finished. Infected files are removed. The SHA-256 of every upload is compared with a blocklist of known malicious or illegal content.

Files larger than 500 MB are not scanned.
For end-to-end encrypted files only the encrypted blob passes through the scanner and the blocklist. That catches files merely labelled as encrypted and reveals nothing about real ciphertext.

Scanning is best effort. A file marked clean can still be harmful. Download at your own risk.

Metadata removal

For files encrypted by the server, we remove metadata from the formats we can handle:

Images (JPEG, PNG, WebP): everything not needed to show the picture, including EXIF (GPS, camera, timestamps), XMP, IPTC, comments, embedded thumbnails and anything appended after the image, such as the video of a motion photo. The picture is not re-encoded and its rotation is kept.
PDF documents: author, title, subject, keywords and the creating software.

Other formats (GIF, TIFF, HEIC/AVIF, camera RAW, Word, Excel, MP3, MP4, ZIP and so on) are stored unchanged, including the files inside an archive.
Large files are stored unchanged: images over 25 MB and PDFs over 10 MB.
End-to-end encrypted files cannot be processed. Remove metadata yourself before uploading.
File size is not padded and can itself be identifying.

Pastes

Pastes created at tmp0.cc/paste or through the API are stored in our database until they expire (1 hour to 30 days), reach their view limit or are deleted. We store the content, language, title, line and character count, expiry, counters and the delete token.

The content is stored as you sent it and is readable by the server. Unlike files, pastes are not encrypted at rest.
A password on a paste is checked by the server. We store a bcrypt hash of it and ask for it before showing the paste. It does not encrypt the content, and five wrong attempts delete the paste.
For an end-to-end encrypted paste use the command line tool with -e. It encrypts before sending and we store ciphertext only. Such a paste is read back with the tool as well.

IP addresses and abuse protection

The server needs your IP address to answer you. It is not written to the database, and the following is all that is derived from it. All of it lives in memory and is gone after a restart.

Rate limiting: request counts per address, kept under a keyed hash (HMAC-SHA256 with a server secret) and dropped after minutes to hours of inactivity.
Failed attempts: wrong delete tokens and requests for IDs that do not exist are counted per hashed address for up to one hour. Too many lead to a block of 30 minutes to one hour.
Abuse score: failed API keys, rapid uploads, repeated identical uploads, scanning for IDs and rate limit hits add to a score per hashed address. Above a threshold the address is blocked for 15 minutes. The score is dropped after a few minutes without new findings.
Recognising bots: for clients that uploaded something or did something suspicious, the keyed hash is linked for at most 24 hours to their recent uploads (ID, size and a content fingerprint) and to failed or refused requests. Our team sees this under a pseudonym and can block that hash, also for longer, or remove what it uploaded. The address itself is never shown.

A keyed hash cannot be turned back into an address without the server's secret. It is still a pseudonym, not anonymity: while it exists, requests from the same address can be recognised as such.

Statistics and logs

Cookies and browser storage

No cookie is set as long as you are not logged in.
Logging in with Discord sets one session cookie. It is not readable by scripts and is not sent with background requests made by other websites.
Your browser remembers your last upload settings (storage time and options) in its local storage, and holds a paste draft while you move between pages. Neither is sent to us.

Discord login (optional)

Logging in is voluntary and only adds a dashboard that lists what you shared while logged in. We ask Discord for basic identification and nothing else.

Deleting the account: you can remove the connection in your dashboard at any time. That deletes the data above. Files and pastes you shared stay available until they expire but are no longer linked to you, and logging in again does not bring the link back. Delete them first if you want them gone.

Direct transfer

Direct transfer sends a file from one browser to another over an encrypted WebRTC connection. The file, its name, its size and its type never reach our server.

To connect the two browsers, our server passes connection details between them. These include the IP addresses of both sides. They are held in memory and discarded with the room, after ten minutes at most.
The other side learns your IP address. That is how a direct connection works.
Your browser asks STUN servers run by Google and Cloudflare for its public address. They see your IP address, not the transfer.
If no direct connection is possible, a relay (TURN) may carry the encrypted traffic. It cannot decrypt it.

Third parties

Scripts, styles, icons and fonts come from our own server. Loading a page sends no request to a CDN or font service, and our Content Security Policy makes browsers refuse scripts, styles and fonts from anywhere else. QR codes are generated in your browser.

The exceptions are named above: Discord, if you log in (including your profile picture from cdn.discordapp.com), and the STUN servers during a direct transfer. We do not sell or share data, and we use no outside processors for it.

What browser encryption depends on

End-to-end encryption in a browser relies on the JavaScript our server delivers. If the server were compromised, altered code could read a password before it is used. This is a limit of every browser-based encryption.

All of that code comes from our own server, so no third party can alter it. If you do not want to rely on it, use the command line tool, which encrypts locally and does not load code from the website.

Retention and deletion

Files and pastes are deleted when they expire (1 hour to 30 days), when their download or view limit is reached, after five wrong server-side passwords, or when you use the delete link.
The database entry is deleted together with the file. Files up to 50 MB are overwritten with random data first.
Every upload comes with a delete link containing a 32-character token. Anyone who has it can delete the file, so keep it private. We cannot restore what was deleted.
Entries in the transparency log and the usage statistics remain, as described above. Neither contains content, names or addresses.

Encryption keys

Files encrypted by the server each get their own key, derived with HKDF-SHA256 from a master key and a random salt stored with the file.
The master key is part of the server's configuration and is not stored with the files. Whoever holds both the key and the stored files can decrypt them. That includes us.
For end-to-end encrypted files none of this matters: the key is derived from your password in your browser and never reaches us.

Jurisdiction

All legal matters, disputes, and data protection inquiries are governed exclusively by Icelandic law and subject to the jurisdiction of Icelandic courts.

GDPR and EEA data protection

As an EEA member state, Iceland has incorporated the General Data Protection Regulation (GDPR) into national law through the Icelandic Data Protection Act (Lög um persónuvernd og vinnslu persónuupplýsinga).

Government and legal requests

We protect user privacy to the fullest extent permitted by law. Any government or law enforcement request for user data is subject to rigorous legal scrutiny.

What we could hand over at all: for an end-to-end encrypted file, ciphertext and the metadata listed above, never the content, because we do not have the key. For a file or paste without a password, the content is within our reach while it exists.

Transparency report

We publish annual figures on the legal and takedown requests we receive.

Year	DMCA Requests	Government/Legal Requests	Data Disclosed
2025	0	0	0
2026	0	0	0

Last updated: February 2026 • Next update: January 2027

Contact

Questions about this policy or your data: privacy@tmp0.cc. How files are protected is summarised under .

API reference

Upload files, create pastes and check what the server stored, over plain HTTPS. No account and no key required.

Base URL: https://tmp0.cc/api
Authentication: None. Optional API key for higher upload limits
Format: JSON responses, UTF-8
Largest file: 2 GB

Basics

All paths below are relative to the base URL. The fastest way in is a single request:

$ curl -F "file=@report.pdf" https://tmp0.cc/api/v1/upload

Identifiers	File and paste IDs are 12 letters and digits. A delete token is 32. The delete token is returned once, when the file or paste is created, and cannot be looked up later.
Expiry	`1h`, `6h`, `12h`, `1d`, `3d`, `7d`, `14d` or `30d`. The default is `7d`, and a value that is not recognised falls back to it instead of failing.
Passwords	A `password` sent to the API is checked by the server and stored as a hash; it may be up to 72 bytes long. Five wrong attempts delete the file or paste. For end-to-end encryption, encrypt before you upload, as the does with `-e`.
Timestamps	`expiresAt` on files and pastes is the server's local time without a UTC offset. Signed links and the transparency log use UTC.
API keys	Send `X-API-Key` with `POST /v1/upload` to raise the limit from 10 to 30 uploads a minute (200 an hour). Keys are issued by us on request, see . A key that is not valid is answered with `401`, never treated as anonymous.
Browsers	The API is made for scripts, servers and tools. It sends no CORS headers, and a request from another website that changes something is refused with `403`.
Timing	Lookups, deletions and refused downloads take at least 200 ms, so the timing does not reveal whether an ID exists.

Files

Upload a file, read its status, download it and delete it. Every stored file is encrypted at rest and removed when it expires or reaches its download limit.

POST/v1/uploadUpload a file

Send multipart/form-data. Only file is required.

Field	Type	Description
`file`required	file	The file, up to 2 GB.
`expires`	string	How long to keep it. Default `7d`.
`maxDownloads`	integer	Delete after this many downloads. At least 1; unlimited when left out.
`burnAfterReading`	boolean	Delete after the first download.
`password`	string	Required again to download. Up to 72 bytes.
`note`	string	Shown to the recipient on the download page. Cut off after 500 characters.
`clientEncrypted`	boolean	The file is already encrypted in the tmp0 end-to-end format. The download page then asks for the password and decrypts in the browser. Parameters: `GET /v1/crypto/manifest`.

Request

$ curl https://tmp0.cc/api/v1/upload \
       -F "file=@report.pdf" \
       -F "expires=1d" \
       -F "maxDownloads=5" \
       -F "note=Q3 figures"

Response · 200

{
  "success": true,
  "fileId": "a1B2c3D4e5F6",
  "sha256": "9f86d081884c7d65…",
  "url": "/d/a1B2c3D4e5F6",
  "fullUrl": "https://tmp0.cc/d/a1B2c3D4e5F6",
  "directDownloadUrl": "https://tmp0.cc/api/file/a1B2c3D4e5F6/download",
  "deleteToken": "k7Qm…",
  "deleteUrl": "https://tmp0.cc/delete/a1B2c3D4e5F6?token=k7Qm…",
  "fileInfo": { "expires": "1d", "maxDownloads": 5 }
}

fullUrl is the page to share. sha256 is the hash of the bytes as the server received them. directDownloadUrl answers to POST, not GET.

Refused with 400: empty files, programs and scripts (.exe, .msi, .bat, .sh, .js, .jar, Office files with macros, disk images and similar, also as a double extension or recognised by content), and files on the hash blocklist.

GET/file/{id}/infoStatus, expiry and counters

Always answers 200. A file that does not exist, has expired or has used up its downloads comes back as "available": false with a message. Fields without a value are left out.

{
  "available": true,
  "fileName": "report.pdf",
  "fileSize": 482113,
  "contentType": "application/pdf",
  "note": "Q3 figures",
  "passwordRequired": false,
  "clientEncrypted": false,
  "burnAfterReading": false,
  "viewCount": 3,
  "downloadCount": 1,
  "maxDownloads": 5,
  "expiresAt": "2026-11-12T14:03:27",
  "scanStatus": "CLEAN",
  "fileHash": "9f86d081884c7d65…",
  "riskLevel": "low"
}

scanStatus is PENDING, CLEAN, INFECTED, ERROR or SKIPPED. Files encrypted before upload cannot be scanned. After 15 requests for IDs that do not exist, an address is locked out of this route for 30 minutes.

GET/v2/files/{id}The same, with 404 for missing files

Returns 404 with { "success": false, "error": "…" } when the file is not available, which is easier to handle in a script. On success every field is present; text fields without a value are empty strings and maxDownloads is 0 for unlimited.

Fields: fileId, fileName, fileSize, contentType, note, clientEncrypted, burnAfterReading, expiresAt, downloadCount, maxDownloads, viewCount, scanStatus, scanResult, fileHash, signed, signatureVerified, senderPublicKey, senderFingerprint, isolated, executable, detectedMimeType, mimeTypeMismatch, riskLevel and privacyLevel (basic, standard, high or maximum).

POST/file/{id}/downloadDownload the file

Answers with the file itself and a Content-Disposition header carrying its name. The request counts as a download: it uses up one of maxDownloads and destroys a burn-after-reading file. For a protected file, send password as a form field.

$ curl -X POST -OJ https://tmp0.cc/api/file/a1B2c3D4e5F6/download

$ curl -X POST -OJ -d "password=correct horse" \
       https://tmp0.cc/api/file/a1B2c3D4e5F6/download

Status	Meaning
`400`	Not found, expired, download limit reached, blocked, or a password is required and none was sent. The reason is in `error`.
`401`	Wrong password. `remainingAttempts` says how many are left.
`409`	The malware scan has not finished. Try again after the seconds in `Retry-After`.
`410`	The fifth wrong password deleted the file.

A file that was encrypted before upload is sent as it was stored. Decrypting it is up to the client.

DELETE/file/{id}?token={deleteToken}Delete before it expires

$ curl -X DELETE "https://tmp0.cc/api/file/a1B2c3D4e5F6?token=k7Qm…"

{ "success": true, "message": "File deleted successfully" }

A wrong token is answered with 403 and remainingAttempts. After ten wrong tokens the address is blocked from deleting for an hour (429).

GET/file/{id}/previewInline preview of an image

Returns the image for PNG, JPEG, GIF, WebP and SVG files that have no password, and 404 for everything else. It does not count as a download and supports ETag / If-None-Match.

Pastes

Text and code with syntax highlighting. A paste holds up to 10,000 lines or 500,000 characters.

POST/snippet/createCreate a paste from text or JSON

With Content-Type: text/plain the body is the paste and the options are query parameters, which suits a pipe. With application/json the same options go into the body, next to content.

Option	Type	Description
`content`required	string	JSON only. With `text/plain` it is the request body.
`language`	string	For highlighting, such as `python`, `go`, `json` or `bash`. Detected from the content when left out.
`autoDetect`	boolean	Default `true`. Set `false` to store a paste without a language as plain text.
`title`	string	Shown above the paste. A file name here also helps detection.
`expires`	string	How long to keep it. Default `7d`.
`maxDownloads`	integer	Delete after this many views.
`burnAfterReading`	boolean	Delete after the first view.
`password`	string	Required again to read. Up to 72 bytes.

Request

$ cat main.py | curl --data-binary @- \
       -H "Content-Type: text/plain" \
       "https://tmp0.cc/api/snippet/create?expires=1d&title=main.py"

$ curl https://tmp0.cc/api/snippet/create \
       -H "Content-Type: application/json" \
       -d '{"content":"print(1)","language":"python","burnAfterReading":true}'

Response · 200

{
  "success": true,
  "snippetId": "b2C3d4E5f6A1",
  "language": "python",
  "url": "/paste/b2C3d4E5f6A1",
  "fullUrl": "https://tmp0.cc/paste/b2C3d4E5f6A1",
  "rawUrl": "https://tmp0.cc/api/snippet/b2C3d4E5f6A1/raw",
  "deleteToken": "p9Xw…",
  "deleteUrl": "https://tmp0.cc/paste/b2C3d4E5f6A1/delete?token=p9Xw…"
}

Use --data-binary, not -d: curl's -d removes the line breaks. A burn-after-reading paste also returns "burnAfterReading": true.

GET/snippet/{id}/rawThe paste as plain text

$ curl https://tmp0.cc/api/snippet/b2C3d4E5f6A1/raw
$ curl "https://tmp0.cc/api/snippet/b2C3d4E5f6A1/raw?password=…"

Each GET counts as a view and uses up a burn-after-reading paste. HEAD on the same address only says whether the paste exists (200 or 404) and counts nothing. Errors on this route are plain text: 401 for a wrong password, 410 once the fifth wrong password has deleted the paste.

POST/snippet/{id}/contentThe paste as JSON, with its metadata

Takes password as a form field or query parameter when the paste is protected. Counts as a view, like /raw.

{
  "success": true,
  "content": "print(1)",
  "language": "python",
  "title": "main.py",
  "lineCount": 1,
  "charCount": 8
}

GET/snippet/{id}/infoMetadata without reading the paste

Does not count as a view. Always answers 200; a paste that is gone comes back as "available": false with a message.

{
  "available": true,
  "snippetId": "b2C3d4E5f6A1",
  "title": "main.py",
  "language": "python",
  "lineCount": 1,
  "charCount": 8,
  "passwordProtected": false,
  "clientEncrypted": false,
  "burnAfterReading": false,
  "remainingDownloads": 4,
  "expiresAt": "2026-11-12T14:03:27"
}

DELETE/snippet/{id}?token={deleteToken}Delete a paste

Works like deleting a file: 200 with "success": true, 403 with remainingAttempts for a wrong token.

Direct upload

Two steps instead of one: announce the upload, then send the raw bytes to a single-use address. The body is streamed to disk without multipart encoding, and the address can be handed to another machine, which then needs nothing but the URL.

POST/v2/presignReserve an upload address

Field	Type	Description
`fileName`required	string	Name the file is stored and offered under. Up to 255 characters.
`fileSize`	integer	Size in bytes. Refused right away if it is over the limit.
`contentType`	string	MIME type of the file.
`storageTime`	string	Same values as `expires`. Default `7d`.
`maxDownloads`	integer	At least 1.
`burnAfterReading`	boolean	Delete after the first download.
`note`	string	Up to 500 characters.
`clientEncrypted`	boolean	The body will be in the tmp0 end-to-end format.

$ curl https://tmp0.cc/api/v2/presign \
       -H "Content-Type: application/json" \
       -d '{"fileName":"backup.tar.gz","storageTime":"1d"}'

{
  "success": true,
  "uploadUrl": "/api/v2/upload/direct/4fTq…",
  "token": "4fTq…",
  "expiresAt": "2026-11-11T14:33:27",
  "validForMinutes": 30,
  "maxFileSize": 2147483648
}

JSON types are strict: a number in quotes or "true" as a string is answered with 400. Reserving counts against the upload limit; the upload itself does not. A server-side password cannot be set on this route.

PUT/v2/upload/direct/{token}Send the file

Send the bytes with Content-Type: application/octet-stream. Alternatively, POST to the same address as multipart/form-data with a part named file.

$ curl -X PUT --data-binary @backup.tar.gz \
       -H "Content-Type: application/octet-stream" \
       https://tmp0.cc/api/v2/upload/direct/4fTq…

{
  "success": true,
  "fileId": "a1B2c3D4e5F6",
  "sha256": "9f86d081884c7d65…",
  "url": "/d/a1B2c3D4e5F6",
  "downloadUrl": "/d/a1B2c3D4e5F6",
  "apiUrl": "/api/v2/files/a1B2c3D4e5F6",
  "deleteToken": "k7Qm…"
}

The address works once and for 30 minutes. An upload that fails gives it back, up to three attempts in total. 404 means unknown or already used, 410 expired, 413 larger than 2 GB.

Signed download links

A plain GET address for a file, signed with HMAC-SHA256, that expires by itself. Useful wherever a POST is impractical: wget, a build script, a link in a message. Files with a password cannot be served this way.

POST/v1/signed/generateCreate a signed link

Field	Type	Description
`fileId`required	string	The file to link to.
`ttl`	integer	Lifetime in seconds, from 1 to 604800 (7 days). Default 3600.
`oneTimeUse`	boolean	The link works for one download.
`ipBinding`	boolean	The link works only from the address that requested it.

$ curl https://tmp0.cc/api/v1/signed/generate \
       -H "Content-Type: application/json" \
       -d '{"fileId":"a1B2c3D4e5F6","ttl":900,"oneTimeUse":true}'

{
  "signedUrl": "https://tmp0.cc/api/v1/signed/download/a1B2c3D4e5F6?sig=…&exp=…&nonce=…&otu=1",
  "fileId": "a1B2c3D4e5F6",
  "expiresIn": 900,
  "ipBound": false,
  "oneTimeUse": true
}

Use signedUrl exactly as returned; changing any part of it invalidates the signature. Booleans must be real JSON booleans.

GET/v1/signed/download/{id}Download through a signed link

Counts as a download like any other. HEAD checks the link and returns the file's headers without using up a one-time link or a download.

Status	Meaning
`403`	The signature is wrong, the link has expired, or it is bound to another address.
`404`	The file is gone, or it needs a password.
`409`	The malware scan has not finished; see `Retry-After`.
`410`	A one-time link that has been used.

POST/v1/signed/verifyCheck a link without downloading

Body: { "url": "…" }. The link is checked for the address that asks, so one bound to another address reports as not valid.

{
  "valid": true,
  "message": "Valid signature",
  "fileId": "a1B2c3D4e5F6",
  "expiresAt": "2026-11-11T13:18:27Z",
  "remainingSeconds": 842,
  "ipBound": false,
  "oneTimeUse": true,
  "alreadyUsed": false
}

Live events

Watch a file instead of polling it. The stream is Server-Sent Events, so curl -N or an EventSource is enough.

GET/v2/events/{id}Subscribe to a file

$ curl -N https://tmp0.cc/api/v2/events/a1B2c3D4e5F6

event:connected
data:{"fileId":"a1B2c3D4e5F6","status":"connected","downloadCount":0,"maxDownloads":5,"expiresAt":"2026-11-12T14:03:27"}

event:download
data:{"downloadCount":1,"maxDownloads":5,"timestamp":1794402207000}

Event	Sent when	Data
`connected`	The stream opens.	`fileId`, `status`, `downloadCount`, `maxDownloads`, `expiresAt`
`download`	The file is downloaded.	`downloadCount`, `maxDownloads` (`-1` for unlimited), `timestamp`
`maxReached`	The download limit is used up.	`message`
`expiring`	Every 30 seconds during the last hour.	`minutesRemaining`
`deleted`	The file is deleted. The stream ends.	`reason`, `timestamp`
`unavailable`	The file expired or is gone. The stream ends.	`reason`
`error`	The subscription was refused. The stream ends.	`error`

A keepalive comment is written every 30 seconds. A stream is closed after 30 minutes; reconnect to keep watching. One address may hold five streams at a time.

Verification

Every upload, download and deletion is recorded in an append-only, signed log that contains hashes only. These routes let anyone check a file against it, and read how files are encrypted. They are read-only and need nothing but a file ID.

Endpoint	Returns
`GET /v1/transparency/verify/{id}`	Whether the file's log entry and its signature check out: `valid`, `message`, `logId`, `merkleRoot`, `timestamp`, `signature`.
`GET /v1/transparency/log/{id}`	The latest entry for a file: `operationType`, `contentHash`, `entryHash`, `merkleRoot`, `treeSize`, `totalEntries`. `404` if there is none.
`GET /v1/transparency/verify/entry/{logId}`	The check for a single entry, with its `previousHash`.
`GET /v1/transparency/sth`	The signed tree head: `treeSize`, `merkleRoot`, `timestamp`, `signature`.
`GET /v1/transparency/public-log?limit=50`	The most recent entries, at most 100.
`GET /v1/transparency/stats`	Entries per operation, tree size and current root.
`GET /v1/crypto/manifest`	The algorithms and parameters in use, for end-to-end and at-rest encryption.
`GET /v1/crypto/manifest/{id}`	The same for one file, with a `badgeHash` over the answer.
`POST /v1/crypto/verify-badge`	Body `{ "fileId", "badgeHash" }`. Says whether a badge hash seen earlier still matches the file.

$ curl https://tmp0.cc/api/v1/transparency/verify/a1B2c3D4e5F6

{
  "valid": true,
  "message": "…",
  "fileId": "a1B2c3D4e5F6",
  "logId": "0b9c7f52-6d1e-4c0a-9a57-3f2f1f6f0f1e",
  "merkleRoot": "…",
  "timestamp": "2026-11-11T13:03:27Z",
  "signature": "…"
}

The verify routes answer 200 with "valid": false when there is nothing to verify. The same checks have a page of their own at /verify.

Service information

`GET /v2/config`	Limits and features as the server enforces them: `maxFileSize`, `storageTimes`, `features`, `endpoints`. Read this instead of hard-coding the values.
`GET /storage/status`	Storage in bytes: `used`, `limit`, `available`, `usedPercent`.
`GET /v2/stream/status`	Open event streams: `activeConnections`, `trackedFiles`, `status`.

Rate limits

Limits are counted per IP address and refill continuously over a minute. An address is never stored; it is counted as a keyed hash that is forgotten within hours.

What	Limit	Applies to
File uploads	10 / min	`POST /v1/upload`, `POST /v2/presign`
File uploads with a key	30 / min, 200 / h	`POST /v1/upload` with `X-API-Key`, counted per key
Pastes	5 / min	`POST /snippet/create`
Downloads and reads	60 / min	File downloads, signed downloads, `/raw`, `/content`
Downloads of one file	50 / min	Counted per file, across all addresses
Metadata	30 / min	File and paste info, `/v2/files`, previews, opening an event stream, ShareX configs
Verification	60 / min	Transparency log, crypto badges, `/v1/signed/verify`
Other requests	30 / min	`/v1/signed/generate`, `/v2/config`, `/v2/stream/status`

Over the limit, the answer is 429. Uploads, pastes and the verification routes add Retry-After in seconds; uploads and pastes also send X-RateLimit-Limit and X-RateLimit-Remaining. Wait for the time given instead of retrying at once: an address that keeps running into the upload limit, or sends wrong API keys, is blocked for a while.

Errors

Errors use HTTP status codes and a JSON body with a readable error. The upload, paste and /v2 routes add "success": false.

{ "success": false, "error": "maxDownloads must be at least 1.", "statusCode": 400 }

Status	Meaning
`400`	The request cannot be carried out: a missing or malformed field, a file type that is not accepted, a file that has expired. Read `error`.
`401`	Wrong password for a file or paste, or an API key that is not valid.
`403`	Wrong delete token, a signed link that does not verify, or a request sent by another website.
`404`	No such file, entry or upload address. The older `/file` and `/snippet` info routes answer `200` with `"available": false` instead.
`409`	The file is still being scanned for malware. Retry after `Retry-After`.
`410`	Gone for good: deleted after five wrong passwords, a one-time link already used, or an upload address that expired.
`413`	The body is too large: 2 GB for uploads, 4 MB for everything else.
`429`	Too many requests, or too many failed attempts.

Tools

Two ready-made clients for the routes above.

ShareX

Import a custom uploader for screenshots, files and text. Uploads are kept for 30 days.

For other defaults, fetch a config from /v1/sharex-config or /v1/sharex-text-config with ?expires=1d or &burnAfterReading=true.

Command line

A Node script that uploads, downloads and verifies, and can encrypt end-to-end before anything leaves your machine.

$ curl -O https://tmp0.cc/api/v1/cli/tmp0.js
$ curl -O https://tmp0.cc/api/v1/cli/package.json
$ npm install

$ node tmp0.js upload report.pdf -x 1d
$ node tmp0.js upload secret.zip -e -p "…"
$ cat main.py | node tmp0.js paste -t main.py
$ node tmp0.js verify a1B2c3D4e5F6

Commands: upload, download, paste, paste-get, info, verify, delete, manifest. Add -j for JSON output and --help for the options of each.

Share a file.
It disappears.

Upload without a password?

That looks like text

ShareX

Command line

Share a file.It disappears.

Upload without a password?

That looks like text

DMCA Takedown Policy

Overview

Safe Harbor Notice

Filing a DMCA Takedown Request

Submit Request

Our Response

Counter-Notification

Frequently Asked Questions

How does it work?

Do I need an account?

What are the limits?

How private is it?

Can I delete something early?

What about text and code?

Can I send a file without uploading it?

Is there an API?

Privacy Policy

In short

How a file is protected

What we store for a file

Malware scan and blocklist

Metadata removal

Pastes

IP addresses and abuse protection

Statistics and logs

Cookies and browser storage

Discord login (optional)

Direct transfer

Third parties

What browser encryption depends on

Retention and deletion

Encryption keys

Jurisdiction

GDPR and EEA data protection

Government and legal requests

Transparency report

Contact

Terms of Service

1. Agreement

2. The service

3. Your responsibilities

4. Prohibited content

5. Scanning and refused files

6. Limits

7. Expiry and deletion

8. Abuse prevention

9. Age Requirement

10. Service Availability

11. Disclaimer of Warranties

12. Limitation of Liability

13. User-Generated Content

14. Indemnification

15. Safe Harbor

16. Changes to Terms

17. Governing Law & Jurisdiction

18. Contact

Imprint / Legal Notice

Operator

Legal Structure

Get in Touch

General Support

Report Abuse

Legal / DMCA

Privacy Concerns

Response Times

API reference

Basics

Files

Pastes

Direct upload

Signed download links

Live events

Verification

Rate limits

Errors

Tools

ShareX

Share a file.
It disappears.