How it works

Client-side encryption

Your text is encrypted in your browser using AES-GCM before being sent to our servers. We never see your original content - only the encrypted data.

Zero-knowledge architecture

The encryption key is generated locally and stored in the URL fragment (the part after #). This key never leaves your device or reaches our servers, ensuring true zero-knowledge operation.

Password protection

When you add a password, it's cryptographically combined with the base encryption key using HKDF key derivation. The password stays on your device only - we can't recover it even if we wanted to.

Secure deletion

To delete a paste, you prove ownership by decrypting the content and providing an HMAC signature. No accounts, passwords, or server-side secrets required.

Automatic expiration

Pastes automatically expire based on time limits or view counts you set. Once expired, they're permanently wiped from our servers with no recovery possible.