Blog

Why one minute

2026-09-25

This post contains affiliate links. As an Amazon Associate, ZAGO.TO earns from qualifying purchases.

A minute is not very long. It is short enough that people ask us about it, usually some version of "could you make it five?"

We could. We chose not to, and the reasoning is worth writing down because it explains most of the rest of the design.

The two clocks

There are two timers, and they do different jobs.

Unopened: one minute. You paste text, you get four digits, and if nobody types those digits within a minute, the text is deleted and the code stops meaning anything.

After opening: one more minute. The moment someone opens it, a second minute starts. When that runs out, it is gone from the server whether or not anyone is still looking at the screen.

So the longest any text exists on our side is about two minutes, and that only happens if it is opened right at the end of the first window.

Why the unopened timer is short

The unopened timer answers one question: how long is a live code sitting around waiting to be guessed?

Four digits is ten thousand combinations. That is a small space. Someone typing random codes will eventually land on a live one, which is a real weakness and we deal with it in three ways at once.

The first is rate limiting. Ten wrong codes from the same address within ten minutes and that address is blocked. This alone makes brute force impractical, because you cannot get through a meaningful fraction of ten thousand codes at ten tries per ten minutes.

The second is the PIN. Put a 4-digit PIN on a message and guessing the code only gets you to a locked door. Three wrong PINs and the code is dead.

The third is the clock, and it is the one that scales. A code that exists for a minute is exposed for a minute. Stretch that to an hour and the same code sits there sixty times longer for someone to stumble onto, while every other protection stays the same. Shortening the window is the cheapest safety we have, and it costs the sender nothing when the exchange is happening right now anyway.

Why the second timer exists at all

You might ask why the text does not just vanish the instant it is read.

Because people paste long text. If we deleted on open, a slow connection or a scroll partway down would lose it, and the sender has no way to send it again since they never had a copy either. One minute is enough to read a screen and copy what you need, and short enough that walking away from an open screen does not leave it open all afternoon.

It is also a hedge against the most common real-world failure, which is not an attacker. It is leaving the page open on a shared computer and forgetting. A minute closes that door by itself.

What five minutes would actually buy

Here is the honest version of the trade.

Five minutes would help in one situation: you send a code to someone who is not at their device yet. You say the digits, they say "hold on, let me get my laptop," and by the time they type it the code is dead.

That is a real annoyance and we do not pretend otherwise. The answer we chose is that resending takes three seconds. You paste again, you get new digits, you say four numbers. It is a smaller cost than making every message live five times longer.

The reason we weigh it that way is that the second case is much more common than the first. Most uses of this are immediate: two people on a call, a person at two devices, someone standing at a counter. In those, one minute is generous. Making everything slower to accommodate the occasional wait would mean every message sits exposed longer so that a minority of them are more convenient.

What the clock is standing in for

The short answer to "why not longer" is that the clock is doing a job something else would otherwise have to do. We wrote separately about why the code is four digits rather than six; the timer is the other half of that decision, and the two are not independent.

Worth noting what the timer is not. It is not a promise about the recipient. Once the text is on their screen, they can keep it forever by copying it, and that is true of every service of this kind including the ones built around self-destruction. The clock governs our copy. Nothing more.

It is also not a guarantee that the exchange was private. It narrows how long a code is useful to a stranger. It does not tell you who typed it.

When one minute is wrong

It is wrong whenever you want the text later. Everything above assumes the exchange is happening now, between people or devices that are both present. For anything you will want tomorrow, the entire design is the wrong shape and you should use something that keeps things.

It is also worth saying what the timer does and does not cover. It governs our server. Once the text is on the receiving screen, it is out of our hands: the clipboard holds it, the browser history has the address, and a person looking over a shoulder has seen it. Deleting our copy does not reach any of that.

The short version

One minute is not a limitation we are apologising for. It is the thing that lets the code stay four digits.

Short code, short life, hard limits on guessing. Take any one of those away and the other two have to work harder. Two minutes of total existence is the price of a number you can say out loud.