You probably shouldn't. But when you genuinely have to, here's how to move a private key without leaving a copy on every backup server in the chain.
First ask whether you can avoid it by adding the recipient's public key to authorized_keys instead. If you really have to send a private key, passphrase-protect it with ssh-keygen -p, paste it into textdrop.sh as code, turn on burn-after-read, add an access password, and send the link, the access password, and the passphrase through three different channels.
Code format, burn-after-read, password protection, and a 1-hour expiry are already on. Include the full key, BEGIN and END lines included.
Send the link, the paste password, and the key passphrase through three different channels.
A leaked private key is a permanent open door until someone notices and rotates it. Most key leaks aren't exploited from where they were leaked. They're harvested out of email exports, chat archives, or laptop backups months later. A one-time encrypted link with a passphrase removes both the long-lived copy and the single-secret failure mode.
Almost never. The right pattern is for each person to generate their own keypair and add their public key to authorized_keys. Share a private key only when you're cloning a service account, handing off a one-off contractor, or recovering access where rotation is genuinely not possible right now.
The file ends up on your sent folder, the recipient's inbox, both providers' servers, every backup of either account, and almost certainly the recipient's Downloads folder for months. Any one of those is a single-breach away from full server access.
Yes. If the key isn't already protected by a passphrase, add one with `ssh-keygen -p -f path/to/key` before sharing. Combined with an access-password on the paste, that's two independent secrets the attacker needs.
The shortest one your recipient can realistically meet. One hour is right if you're in a live conversation. Burn-after-read makes the expiry mostly a backstop: it self-destructs on first view regardless.
If the key has lived in chat, email, or a ticket at any point, yes. After a clean one-time-link transfer with a passphrase, rotation is good hygiene whenever the recipient no longer needs access.
Skip the doc, the wiki, and the email thread. Drop your notes into a Markdown paste, set an expiry, and send a single link your team can read in their browser.
AES-256-GCM, PBKDF2 key wrapping, and what zero-knowledge actually means here.