Is cinderpaste really zero-knowledge?

Yes. Your text is encrypted in your browser with AES-256-GCM before anything is sent. The server only ever stores ciphertext, a random IV, and (for password pastes) a salt. It never receives the plaintext or the key, so we genuinely cannot read your content.

How is this different from Pastebin?

Classic pastebins store your text in plaintext on their servers, which means the operator — and anyone who compromises them — can read it. cinderpaste encrypts everything client-side, adds burn after reading, and requires no account, so there's nothing readable to leak.

Can I share passwords safely?

That's one of the most common uses. Create a paste with the password, turn on burn after reading, and send the link. The recipient opens it once and the credential self-destructs, which is far safer than leaving it in chat or email history.

What happens after a paste is destroyed?

It's unrecoverable. A burned or expired paste is deleted from the database, and because the key was never stored server-side, there's no way to bring it back — not by us, and not by anyone who seizes the server.

No content logs, no analytics, and no tracking cookies. Rate limiting uses a keyed hash of your IP address rather than the raw address, and that hash isn't tied to your pastes.

Yes. cinderpaste is designed to run as a small, self-contained service, so you can deploy your own instance on your own infrastructure if you'd rather not rely on the hosted version.

Yes, the hosted service is free to use. There are no accounts, no paywalls, and no premium tier gating the encryption — the security model is the same for everyone.

How long can a paste last?

You choose an expiry between ten minutes and one month. Once it lapses, the paste is purged automatically. Burn-after-reading pastes can also disappear sooner — as soon as they're opened once.

What if I lose the link?

Then the paste is gone. The decryption key lives only in the link's fragment, so if you lose the link (or the passphrase), no one — including us — can recover the content. Keep the link safe until it's been read.

Can I use this for API keys?

Absolutely. Sending API keys and tokens through encrypted, burn-after-reading links keeps them out of plaintext chat and email. Pair it with a short expiry and rotate the key after it's been received.

Which browsers are supported?

Any modern browser with the Web Crypto API — that includes current versions of Chrome, Firefox, Safari, and Edge on both desktop and mobile. No extensions or plugins are needed.

Can the server operator read my paste?

No. Even someone with full access to the server sees only encrypted blobs. The key never leaves the browser and is never stored, which is exactly what makes the model zero-knowledge.

Frequently Asked Questions

Everything you might want to know about encrypted, self-destructing pastes — from the zero-knowledge model to sharing passwords and API keys.

Is cinderpaste really zero-knowledge?: Yes. Your text is encrypted in your browser with AES-256-GCM before anything is sent. The server only ever stores ciphertext, a random IV, and (for password pastes) a salt. It never receives the plaintext or the key, so we genuinely cannot read your content.
How is this different from Pastebin?: Classic pastebins store your text in plaintext on their servers, which means the operator — and anyone who compromises them — can read it. cinderpaste encrypts everything client-side, adds burn after reading, and requires no account, so there's nothing readable to leak.
Can I share passwords safely?: That's one of the most common uses. Create a paste with the password, turn on burn after reading, and send the link. The recipient opens it once and the credential self-destructs, which is far safer than leaving it in chat or email history.
What happens after a paste is destroyed?: It's unrecoverable. A burned or expired paste is deleted from the database, and because the key was never stored server-side, there's no way to bring it back — not by us, and not by anyone who seizes the server.
Do you keep logs?: No content logs, no analytics, and no tracking cookies. Rate limiting uses a keyed hash of your IP address rather than the raw address, and that hash isn't tied to your pastes.
Can I self-host it?: Yes. cinderpaste is designed to run as a small, self-contained service, so you can deploy your own instance on your own infrastructure if you'd rather not rely on the hosted version.
Is it free?: Yes, the hosted service is free to use. There are no accounts, no paywalls, and no premium tier gating the encryption — the security model is the same for everyone.
How long can a paste last?: You choose an expiry between ten minutes and one month. Once it lapses, the paste is purged automatically. Burn-after-reading pastes can also disappear sooner — as soon as they're opened once.
What if I lose the link?: Then the paste is gone. The decryption key lives only in the link's fragment, so if you lose the link (or the passphrase), no one — including us — can recover the content. Keep the link safe until it's been read.
Can I use this for API keys?: Absolutely. Sending API keys and tokens through encrypted, burn-after-reading links keeps them out of plaintext chat and email. Pair it with a short expiry and rotate the key after it's been received.
Which browsers are supported?: Any modern browser with the Web Crypto API — that includes current versions of Chrome, Firefox, Safari, and Edge on both desktop and mobile. No extensions or plugins are needed.
Can the server operator read my paste?: No. Even someone with full access to the server sees only encrypted blobs. The key never leaves the browser and is never stored, which is exactly what makes the model zero-knowledge.

How cinderpaste Works →

← Back to cinderpaste