Secure pastebin — encrypted, private, no logs

Three layers of privacy

1. 1

   No identity, no logs

   No account, no email, no IP stored. Rate-limiting uses a one-way hash that cannot be reversed. There is no record linking you to a paste.

2. 2

   Paste pages not indexed

   All paste pages are served with noindex, nofollow robots directives. Google cannot find your paste. Only people you share the link with can access it.

3. 3

   End-to-end encryption (optional)

   Enable encryption and the paste is AES-256 encrypted in your browser before it leaves your device. The decryption key lives only in the URL fragment — the server stores ciphertext only and cannot read your content.

Security and privacy features

When to use a secure paste

• Sharing an API key, token, or password with a colleague — use burn-after-read so it vanishes after one view
• Sending sensitive config files — use end-to-end encryption so only the recipient can read it
• Sharing private code snippets during a security review
• Storing a temporary note you do not want to appear in search results
• Sharing credentials in a support ticket without the provider seeing them

Frequently asked questions

Is NullPaste really secure?

NullPaste does not store IP addresses, runs no analytics or third-party trackers on paste pages, and offers optional browser-side end-to-end encryption where the server never receives the decryption key. Paste pages are served with noindex directives so they are not discoverable via search engines.

How does end-to-end encryption work on NullPaste?

When you enable encryption, NullPaste generates a random AES-256 key in your browser and encrypts the paste content before sending anything to the server. The encryption key is appended to the share URL as a fragment (the #... part). URL fragments are never sent to the server by the browser, so NullPaste stores only the encrypted ciphertext and has no ability to read your content.

Can NullPaste read my encrypted paste?

No. The decryption key only ever exists in the URL fragment, which the browser never transmits to the server. NullPaste's database contains only ciphertext — without the fragment, the content is mathematically unreadable.

Does NullPaste store my IP address?

No. Raw IP addresses are never written to any log or database table. Rate-limiting uses a one-way HMAC-SHA256 hash of the IP — the original address cannot be recovered from it. There is no record linking your identity to a paste.

Will Google index my paste?

No. Every paste page is served with noindex, nofollow robots directives. NullPaste does not submit paste URLs to Google Search Console. Your paste is only accessible to people you share the link with.

Is NullPaste safer than Pastebin.com?

NullPaste provides significantly stronger privacy: no IP logging, no analytics on paste pages, optional end-to-end encryption, and noindex on paste pages — none of which Pastebin.com offers. For truly sensitive content, enable end-to-end encryption so the server never sees the plaintext.

What is the difference between password protection and end-to-end encryption?

Password protection restricts who can open a paste — the server still stores the plaintext and checks the password on each request. End-to-end encryption encrypts the content in your browser before it reaches the server, so even NullPaste itself cannot read the paste. For maximum security, use end-to-end encryption. Passwords add an extra access layer on top.