Private Pastebin — encrypted links, no account

A private pastebin with encrypted share links, explained

A pastebin is a place to drop a piece of text — a code snippet, a log, a config file, a note — and get a link to it. Most pastebins store your text on their server, sometimes publicly and sometimes for good. This one works differently: the pastes you keep are stored only in your own browser, and when you share one, the text is encrypted on your device and carried inside the link itself. There is no account and no server that holds your paste.

How the encrypted link works

1. The paste (title, language and text) is compressed with deflate.
2. Your browser creates a random 256-bit key and encrypts the result with AES-256-GCM using the built-in Web Crypto API.
3. The encrypted data and the key are written into the part of the link after the #, like …/#p1.<encrypted paste>.<key>.
4. Browsers never send the part after # to a web server, so when someone opens the link, the page loads normally and the paste is decrypted in their browser.

With a password, no key is put in the link at all. Instead, the key is derived from the password with PBKDF2-SHA-256 and 600,000 rounds, which makes guessing slow. Send the password through a different channel than the link — for example the link by e-mail and the password by phone.

What “private” means here — and its limits

• Anyone who has the complete link can read a paste without a password. Treat the link like the text itself: share it only with the people who should see it.
• Links end up in browser history, chat logs and sometimes link previews. A password protects the paste even when the link leaks.
• The expiry date is stored inside the encrypted paste, and this page refuses to show it afterwards. Because there is no server, it cannot delete copies: someone who saved the link and knows how to decrypt it by hand could still read it. Real “burn after reading” needs a server that destroys the data, and this tool deliberately has none.
• Your own pastes are as private as your device and browser profile. Anyone who can use your browser can open this page and see them.

How long can a shared paste be?

Because the paste travels inside the link, long pastes make long links. Browsers handle very long links, but chat apps, e-mail clients and URL shorteners often cut them off — the page warns you when a link goes past about 8,000 characters. Compression helps a lot with code and logs. Links up to about 2,300 characters also get a QR code, handy for moving a snippet to your phone. For large files, export the paste and send the file instead.

Your own pastes: storage, history and backup

Pastes are saved in the browser’s IndexedDB storage as you type, and the page asks the browser to keep that storage protected from automatic clean-up. Each paste keeps its last 20 versions, so an accidental overwrite can be undone from History. Export downloads a JSON backup of everything; Import merges a backup on another device or browser. Clearing this site’s data or using a private window removes them, so export anything you want to keep. Pastes from the earlier version of this page (stored in localStorage) are moved over automatically.

Syntax highlighting and Markdown

Pick a language and the paste is highlighted — JavaScript, TypeScript, JSON, Python, HTML, CSS, SQL, KQL, Bash, PowerShell, YAML, XML, C#, Java, C/C++, Go, Rust, PHP, Ruby, Diff and Markdown. Dropped files get their language from the file name. Markdown pastes have a live preview; in a shared link they open as formatted text, and links, scripts and other HTML inside them are sanitised so a shared paste cannot run code in the reader’s browser.

Works offline

After your first visit, the page and its editor are stored on your device, so you can write, search and read your pastes — and create share links — without a connection. In Chrome and Edge you can also install it as an app.

When to use which tool

Privacy

Nothing you type is sent anywhere. The page loads its font, editor and (only when you use them) the Markdown renderer and QR library from public CDNs, and counts visits with cookie-free Simple Analytics, which never sees the part of the link after #.

More free tools