Link-only Markdown

Ship the text.
Keep the thread.

Drop a Markdown note into a durable, public-by-link URL. No account, no setup, and an expiry if you want one.

0 / 262,144 bytes

Why a paste beats a screenshot

Free pastebin for Markdown: an unlisted link in one click, an optional expiry, and a plain HTTP API that agents can call with curl.

Why it matters

Most handoffs between people and agents are text: a plan, a log excerpt, a draft, a config. Screenshots lose the words, chat threads bury them, and a shared document needs an account on both ends. A paste is the smallest thing that works. The text lives at one URL that anything with HTTP can read.

The link is the whole access model. Pastes are unlisted, carry a noindex header, and appear in no index or search, so only someone holding the URL can open one. That is enough for a handoff and not enough for a secret. Anyone with the link can read it, so keys, tokens, and personal data do not belong in a paste.

What the tool does

Paste Markdown into the editor, pick an expiry or leave it off, and publish. You get the public URL and a delete token. The token is shown once and stored only as a hash, so keep it if you may want to remove the paste later. A paste holds up to 256 KB, and an expiry can be anything from one second to 365 days. The editor offers one hour, one day, seven days, and thirty days.

The same service answers plain HTTP. POST raw Markdown, or JSON with content and expiresIn, to paste.squadroom.app and read back the URL, the expiry, and the delete token. GET the URL for raw Markdown, add .md to be explicit, or send an Accept header for text/html to get a rendered page. DELETE with the token removes it early. An expired paste stops resolving at once and is cleared from storage on the hourly sweep.

Terms worth knowing

Unlisted
Reachable only by its URL. There is no index, no search, and search engines are told not to list it. Unlisted is not private: the link is the only key.
Token
The 32-character id at the end of a paste URL. It is random, URL-safe, and not guessable in practice.
Delete token
A second random secret returned once when the paste is created. Send it in the X-Delete-Token header to remove the paste before it expires. It is stored as a hash, so it cannot be recovered later.
Expiry
How long the paste stays readable, set in seconds when it is created. An expired paste answers 404 immediately and is deleted from storage on the next hourly sweep.
Raw and rendered
The same paste is served two ways. Raw is the Markdown you sent; rendered is a minimal HTML page. Agents and curl get raw by default, a browser gets the rendered view.

Frequently asked questions

Short answers for the decisions that usually come up after a first run.

Is the paste tool free?

Yes. No account, no sign-up, and no limit on how many pastes you publish. Each paste is capped at 256 KB of text.

Who can read my paste?

Anyone who has the URL. Pastes are unlisted and carry a noindex header, so they are not discoverable, but the link is the only protection. Do not paste secrets, credentials, or personal data.

How long does a paste last?

As long as you choose. Leave the expiry off and it stays until you delete it. Set one and the paste stops resolving the moment it passes, from one second up to 365 days. The editor offers one hour, one day, seven days, and thirty days.

Can I delete a paste?

Yes, with the delete token shown when it was created. Send a DELETE request to the paste URL with the token in the X-Delete-Token header. The token is shown once and stored hashed, so if you lose it the paste can only expire.

How do agents use it?

Over plain HTTP. POST raw Markdown or JSON to paste.squadroom.app and read the URL, expiry, and delete token from the response. One line of curl is enough: curl --data-binary @note.md https://paste.squadroom.app. Add an X-Expires-In header to set an expiry in seconds.

What Markdown is supported?

The raw paste is your Markdown, byte for byte. The rendered HTML view is deliberately minimal: headings, paragraphs, and fenced code blocks. Anything else is shown as plain text, and nothing you paste is executed.

Where is a paste stored?

In a Cloudflare D1 database at the edge, with the delete token kept only as a SHA-256 hash. Expired pastes are removed on an hourly sweep, and every response is sent with no-store so browsers and proxies do not keep copies.