Loading...
Loading...
Share passport numbers and details securely for travel bookings or visa applications.
A passport is two artefacts on one page. The visible number plus expiry is what an airline reservation needs. The Machine-Readable Zone — the two cryptic 44-character lines beginning with P< at the foot of the photo page — is what an automated border kiosk parses. Specified by ICAO Doc 9303, the MRZ encodes nationality, full birthdate, sex, document number, and check digits. Leaking that string tells a forger more than the printed number could.
Photographing the page into a WhatsApp thread or iMessage to a travel agent stores the document where nobody audits. WhatsApp drops media into Google One backups on Android. iMessage attachments sync via iCloud Photos to every device on the family Apple ID. Hotel property-management systems like Opera or Mews often forward scans into a marketing CRM nobody disclosed.
PasteOnce works for the typed handoff. Number, expiry, place of issue, and MRZ travel as text through one ephemeral link without the photo page entering a camera roll. When a scan is unavoidable, route image and typed MRZ through different channels on different days, so a single intercepted message never reconstructs the document.
Client-side encrypted. We can't see your data.
Your data is encrypted in your browser before it leaves your device.
Messages are automatically deleted after being read once.
We never see your data. Only encrypted blobs pass through our servers.
Links work exactly once. Refresh the page and it's gone forever.
Your sensitive data is encrypted in your browser using AES-256-GCM. The encryption key is generated randomly and never sent to our servers.
Only the encrypted blob is stored in our database, with an automatic expiration time. We literally cannot read your data.
When your recipient opens the link, the encrypted data is fetched and immediately deleted from our servers using an atomic Redis GETDEL. The key in the URL hash decrypts the message in their browser.
Most visa portals, hotel pre-arrival forms, and travel-insurance quotations accept typed entries for surname, given names, nationality, document number, sex, birthdate, and expiry. Sending typed values via one-time link avoids materialising a photo in any cloud-synced gallery.
Where a recipient genuinely needs both, send the MRZ string in one paste and the printed details in another, on different channels. The MRZ is the higher-value half; uncoupling it from the human-readable face slows anyone harvesting one channel.
US citizens should register itineraries with the Smart Traveler Enrollment Program at step.state.gov before departure. UK travellers can use FCDO alerts; Canadians have Registration of Canadians Abroad. Pre-registration shaves days off emergency document issuance.
Save a high-resolution scan as an attachment inside 1Password, Bitwarden, or Proton Pass — encrypted at rest, never indexed by OS photo OCR. The vault becomes canonical reference if the original is lost.
A US-bound traveller hires Fragomen or Berry Appleman to draft the DS-160 nonimmigrant visa application. The firm needs surname, given names, document number, issuing authority, MRZ, and travel history. Sending typed details through one ephemeral link beats relaying a JPEG over a paralegal's mailbox.
A Schengen applicant booked a VFS Global appointment in another city. A coordinator confirming the slot needs document number and expiry the morning of the visit. A one-hour TTL link delivers the digits and lapses before the coordinator leaves the venue.
Italy's alloggiati portal, Spain's Mossos d'Esquadra system, and Japan's ryokan registration require document fields before check-in. Rather than emailing a JPEG, the guest sends typed fields the property actually transcribes; the PMS receives clean text.
The Machine-Readable Zone is the two coded lines on the photo page, formatted under ICAO Doc 9303. It packs document type, issuing country, surname, given names, document number, nationality, birthdate, sex, expiry, and check digits into a layout border kiosks parse in milliseconds. A forger working from a complete MRZ produces a more convincing fake than from the printed number alone.
ETIAS (EU authorisation, late 2026 rollout) and US ESTA require you to enter document data yourself on the official .europa.eu and .gov sites. If a third party is filing on your behalf, send typed fields through a one-time link. Unsolicited forms requesting full scans are a known phishing pattern targeting first-time applicants.
Data layout is standardised by ICAO so both share the same MRZ structure. Recovery differs: US State issues replacements through twenty-six dedicated agencies; Schengen citizens go through their home embassy in the country of incident, sometimes meaning cross-border travel.
The service accepts text only. Base64-encoding a JPEG into the textarea defeats the splitting strategy that makes typed handoffs safer. Send the typed MRZ here and arrange a separate, equally short-lived channel for any genuine image.