Skip to main content
NullPaste

How to create an end-to-end encrypted paste

Encrypt a paste in your browser so only the link-holder can read it. The server never sees the key — a complete guide to encrypted pastes.

End-to-end encryption means only you and the people you share the link with can ever read the paste. Even NullPaste's server cannot decrypt it — the encryption key lives only in the URL fragment, which browsers never send to servers.

  1. Open a new paste

    Go to nullpaste.org — no account needed.

  2. Enter your content

    Type or paste the text or code you want to share securely.

  3. Toggle End-to-end encrypt

    Enable the "End-to-end encrypt" switch. NullPaste generates a random encryption key in your browser using the Web Crypto API. Your content is encrypted before it leaves your device.

  4. Create the paste

    Click Create paste. The server receives only the encrypted ciphertext — it cannot read your content. The encryption key is appended to the share URL as a fragment (#key=...) that is never sent to the server.

  5. Share the full link

    Copy the entire URL (including the #key= part) and send it to your recipient. Anyone with the full link can decrypt and read the paste. Anyone without the key sees only encrypted ciphertext.

Encryption vs password protection

A password-protected paste restricts who can open the paste, but the content is still stored on the server and accessible to the server operator. End-to-end encryption goes further — the server stores only ciphertext and has no way to read the original content, even if compelled to.

For secrets, credentials, or anything you don't want the hosting server to ever see, always use end-to-end encryption.

Technical details

  • Encryption is performed client-side using the browser's Web Crypto API
  • AES-256-GCM — the same standard used by modern HTTPS
  • The key is generated fresh for each paste and never transmitted to the server
  • URL fragments (#key=...) are not included in HTTP requests
  • Losing the share link means losing access — there is no key recovery

Frequently asked questions

How does end-to-end encryption work in NullPaste?
NullPaste generates a random AES-256 key in your browser using the Web Crypto API. Your paste content is encrypted with that key before it is sent to the server. The key is appended to the share URL as a fragment (#key=...). Because URL fragments are never included in HTTP requests by browsers, the server never receives the key and stores only ciphertext.
Can NullPaste read my encrypted paste?
No. The decryption key exists only in the URL fragment, which the browser never transmits to the server. NullPaste's database contains only encrypted ciphertext — without the key fragment, the content is mathematically unreadable.
What happens if I lose the share link?
The encryption key exists only in the URL. If you lose the full URL (including the #key= part), the paste cannot be decrypted. There is no key recovery mechanism — this is intentional, as it means no third party can recover your content either.
Is encryption automatic or do I have to enable it?
Encryption is optional and must be enabled explicitly with the End-to-end encrypt toggle. This is intentional — for most pastes (code snippets, notes) full encryption is unnecessary, and enabling it by default would complicate sharing.
Can I share an encrypted paste with multiple people?
Yes. Anyone with the full URL (including the #key= fragment) can decrypt and read the paste. Share the full link with as many recipients as you like. For single-recipient secrets, combine with burn-after-read.
What is the difference between encryption and password protection?
Password protection restricts who can open a paste but the server still stores the plaintext and verifies the password on each request. End-to-end encryption means the server never sees the plaintext at all — only ciphertext is stored. For truly sensitive content, use encryption. Passwords add a useful access control layer on top.

Related guides

Create a paste