Features
cinderpaste is a zero-knowledge paste and an encrypted pastebin alternative built around a single promise: the server never sees your plaintext. Every feature below reinforces that zero-knowledge foundation, from browser-side encryption to links that quietly burn after reading.
End-to-end encryption
Your content is encrypted with AES-256-GCM using the Web Crypto API before it ever leaves your device. The server receives only ciphertext, a random IV, and — for password pastes — a salt. Nobody in the middle, including us, can read it.
Burn after reading
A burn paste is retrieved and deleted in a single atomic transaction, so it can be opened exactly once. It's the safest way to share a one-time secret: after the first view, the ciphertext is gone for good.
Password protection
Add a passphrase and the encryption key is derived from it with PBKDF2-SHA256 over 600,000 iterations. The passphrase is never transmitted, so even the link alone can't unlock the paste without it.
Custom expiration
Choose how long a paste lives — from ten minutes to a month. Expired pastes are purged automatically, so nothing lingers on the server longer than you intend.
QR sharing
Every paste link can be shown as a QR code, so you can move a secret to a phone or another device without typing a long encrypted URL by hand.
No accounts
There's no sign-up, no email, and no password vault to breach. You create an encrypted paste and share it instantly — anonymity is the default, not an upgrade.
Inspectable & self-hostable
All encryption runs in your browser, so you can watch exactly what happens to your data in your browser's developer tools — a zero-knowledge claim you can verify yourself. You can also run your own instance: cinderpaste ships as a small, self-contained service you can deploy on your own server.
Curious how the encryption actually works, or how it holds up under a real threat model?