How to create an end-to-end encrypted paste

End-to-end encryption means only you and the people you share the link with can ever read the paste. Even NullPaste's server cannot decrypt it — the encryption key lives only in the URL fragment, which browsers never send to servers.

1. 1

   Open a new paste

   Go to nullpaste.org — no account needed.

2. 2

   Enter your content

   Type or paste the text or code you want to share securely.

3. 3

   Toggle End-to-end encrypt

   Enable the "End-to-end encrypt" switch. NullPaste generates a random encryption key in your browser using the Web Crypto API. Your content is encrypted before it leaves your device.

4. 4

   Create the paste

   Click Create paste. The server receives only the encrypted ciphertext — it cannot read your content. The encryption key is appended to the share URL as a fragment (#key=…) that is never sent to the server.

5. 5

   Share the full link

   Copy the entire URL (including the #key= part) and send it to your recipient. Anyone with the full link can decrypt and read the paste. Anyone without the key sees only encrypted ciphertext.

Encryption vs password protection

A password-protected paste restricts who can open the paste, but the content is still stored on the server and accessible to the server operator. End-to-end encryption goes further — the server stores only ciphertext and has no way to read the original content, even if compelled to.

For secrets, credentials, or anything you don't want the hosting server to ever see, always use end-to-end encryption.

Technical details

• Encryption is performed client-side using the browser's Web Crypto API
• The key is generated fresh for each paste and never transmitted to the server
• URL fragments (#key=…) are not included in HTTP requests
• Losing the share link means losing access — there is no key recovery

Related guides

• Password-protected pastes — lighter-weight access control
• Burn-after-read — combine with encryption for maximum privacy