Skip to main content
NullPaste

How to password-protect a paste

Add a password to a paste, and learn when to use end-to-end encryption instead for stronger privacy.

A password keeps casual viewers out: even if someone gets the link, they can't read the paste without the password. Here's how to add one.

  1. Write your paste

    Add the text or code you want to keep private.

  2. Set a password

    Enter a password in the optional Password field. The password is hashed with Argon2id on the server, so it is never stored in plain text.

  3. Share the link and password separately

    Send the paste link through one channel and the password through another (for example, the link by email and the password by message). Only someone with both can open it.

Password vs. end-to-end encryption

A password gates access, but the content still reaches the server in a form it can read. For stronger privacy, enable end-to-end encryption: the content is encrypted in your browser and the key is stored only in the share link's fragment, so the server never sees it. Use encryption for anything truly sensitive, and treat a password as a convenient access gate rather than full protection.

For one-time secrets, combine this with burn-after-read. The burn confirmation screen keeps preview bots from consuming the view, and a password means anyone who intercepts the link cannot be the one to open — and burn — the paste.

Frequently asked questions

How do I password-protect a paste on NullPaste?
When creating a paste, enter a password in the Password field before clicking Create Paste. Anyone who opens the link will be prompted to enter the password before the content is shown.
Is the password stored securely?
Yes. Passwords are hashed with Argon2id on the server — the plain-text password is never stored anywhere. Even if the database were compromised, the original password could not be recovered. Note that a password is access control, not encryption: the server still stores the paste content itself.
What is the difference between a password and end-to-end encryption?
A password gates access: the server stores the plaintext and verifies the password on each request. End-to-end encryption goes further — the content is encrypted in your browser and the server stores only ciphertext, which it cannot read under any circumstances. For truly sensitive content, use encryption. For general-purpose access control, a password is usually sufficient.
Can I change the password on a paste after creating it?
No. Paste options are fixed at creation time. To change the password, create a new paste with the desired settings and share the new link.
How do I share both the link and password safely?
Use different communication channels: for example, send the paste link by email and the password via SMS or a separate chat. If an attacker intercepts one channel, they still cannot open the paste without the other half.
Can I combine a password with burn-after-read?
Yes. Burn-after-read already shows a confirmation screen before the content is fetched, so link-preview bots never consume the view. A password adds a second factor: anyone who intercepts the link cannot open — or burn — the paste without it. Keep in mind that whoever does open it can still copy or forward the content.

Related guides

Create a paste