Copy and paste between machines, with nothing but curl.

Push text or a file from one machine, pull it from another within five minutes, and it is gone. Held in memory only, never on disk. Add one flag and it is end-to-end encrypted: the server only ever sees ciphertext.

Try it Open the public pipe Source (Apache-2.0)

Use it

The public instance at https://pipe.0exec.com is free to use within its limits. Every line below works the same in bash and zsh, on Linux and macOS.

# machine A: push, get back a URL
dmesg | tail -50 | curl --data-binary @- https://pipe.0exec.com

# machine B: pull it (within five minutes)
curl https://pipe.0exec.com/Xq7k2aPb

# read once, then gone
echo 'one-time note' | curl --data-binary @- 'https://pipe.0exec.com/?burn=1'

# a name you choose instead of a random id
uname -a | curl --data-binary @- https://pipe.0exec.com/my-slot
curl https://pipe.0exec.com/my-slot

Use --data-binary @-, not -d, which strips newlines. Add ?qr to get a QR code of the link in your terminal, ?words for an id you can say out loud, or ?notify=1 for a read receipt.

End-to-end encryption

Load the small shell helper once, then p -e encrypts on your machine before anything is uploaded. The key lives in the link's #fragment, which browsers and curl never send to a server.

eval "$(curl -s https://pipe.0exec.com/shell)"

echo 'database password: hunter2' | p -e     # prints https://pipe.0exec.com/#id~key
p open 'https://pipe.0exec.com/#Xq7k2aPb~2f9c…'  # on the other machine: fetch and decrypt

p -e -f report.pdf                            # a file that carries its own name, size and sha256
p save 'https://pipe.0exec.com/#…'            # saves it under that name, never overwriting

AES-256-CTR with HMAC-SHA256 (encrypt-then-MAC). Opening an encrypted link in a browser decrypts it in the page, with an image preview and a download button.

What keeps it safe

Gone in five minutes

A hard ceiling enforced in code; ?ttl= can only shorten it. A restart empties everything.

Unguessable ids

Random base62 ids from the system's secure random source. The id is the only secret, so share links privately.

Never executed

Everything is served as text/plain with nosniff: a pasted script or page is shown, never run.

Bounded

10 MiB per entry, a total memory budget, and a per-address write limit. Reads are never limited.

There are no accounts and no token: anyone who has a link can read it until it expires. Use p -e for anything you would not paste in public. Whoever runs a pipe sees sizes, timing and IP addresses, and the content of anything sent without -e.

Run your own

One static Go binary, no database. Put it behind a TLS reverse proxy and set PIPE_TRUST_PROXY=1 there, so the write limit sees real client addresses.

go install github.com/baditaflorin/pipe@latest
PIPE_ADDR=127.0.0.1:18272 pipe

# or with Docker
git clone https://github.com/baditaflorin/pipe && cd pipe && docker compose up -d --build

Every option is in the README.

Used by

AiVoiceBus, a message bus for AI coding agents, sends files through the pipe: aivoicebus send --file encrypts locally and the message carries only the link.