Secure pastebin — encrypted, private, no logs

Three layers of privacy

1. 1

   No identity, no logs

   No account, no email, no IP stored. Rate-limiting uses a one-way HMAC hash of the IP that cannot be reversed — the raw address is never stored or logged.

2. 2

   Paste pages not indexed

   All paste pages are served with noindex, nofollow robots directives and use unguessable IDs. Unlisted is not secret, though — anyone who obtains the link can open an unprotected paste.

3. 3

   End-to-end encryption (optional)

   Enable encryption and the paste is AES-256 encrypted in your browser before it leaves your device. The decryption key lives only in the URL fragment — the server stores ciphertext only and cannot read your content.

Security and privacy features

When to use a secure paste

• Sharing an API key, token, or password with a colleague — use burn-after-read so it vanishes after one view
• Sending sensitive config files — use end-to-end encryption so only the recipient can read it
• Sharing private code snippets during a security review
• Storing a temporary note you do not want to appear in search results
• Sharing credentials in a support ticket without the provider seeing them

Frequently asked questions

Is NullPaste really secure?

NullPaste does not store IP addresses, runs no analytics or third-party trackers on paste pages, and offers optional browser-side end-to-end encryption where the server never receives the decryption key. Paste pages are served with noindex directives so they are not discoverable via search engines.

How does end-to-end encryption work on NullPaste?

When you enable encryption, NullPaste generates a random AES-256 key in your browser and encrypts the paste content before sending anything to the server. The encryption key is appended to the share URL as a fragment (the #... part). URL fragments are never sent to the server by the browser, so NullPaste stores only the encrypted ciphertext and has no ability to read your content.

Can NullPaste read my encrypted paste?

No. The decryption key only ever exists in the URL fragment, which the browser never transmits to the server. NullPaste's database contains only ciphertext — without the fragment, the content is mathematically unreadable. If the fragment is lost, the paste cannot be recovered by anyone, including NullPaste.

Does NullPaste store my IP address?

No. Raw IP addresses are never written to any log or database table. Rate-limiting uses a one-way HMAC-SHA256 hash of the IP — the original address cannot be recovered from it. The server retains only paste metadata such as timestamps and these hashed identifiers, never your raw IP.

Will Google index my paste?

No. Every paste page is served with noindex, nofollow robots directives. NullPaste does not submit paste URLs to Google Search Console. Note that unlisted is not secret: anyone who obtains the link can open an unprotected paste, so add a password or end-to-end encryption for sensitive content.

Is NullPaste safer than Pastebin.com?

NullPaste provides significantly stronger privacy: no IP logging, no analytics on paste pages, optional end-to-end encryption, and noindex on paste pages — none of which Pastebin.com offers. For truly sensitive content, enable end-to-end encryption so the server never sees the plaintext.

What is the difference between password protection and end-to-end encryption?

Password protection is access control — the server still stores the content and verifies an Argon2id hash of the password on each request (the plain-text password is never stored). End-to-end encryption encrypts the content in your browser before it reaches the server, so even NullPaste itself cannot read the paste. For maximum security, use end-to-end encryption. Passwords add an extra access layer on top.