Security Report

cinderpaste assumes the network and the server may be hostile. It's built so that a passive network observer, a curious operator, or an attacker who fully compromises the server still cannot read your content, because the only thing stored is ciphertext.

Content is encrypted with AES-256-GCM, an authenticated cipher that also detects tampering. Keyless shares use a random 256-bit key generated in the browser; password shares derive the key with PBKDF2-SHA256 over 600,000 iterations and a 16-byte random salt.

Server compromise and data seizure (only ciphertext exists), network eavesdropping (content is already encrypted before transit), and long-term exposure (pastes expire and burn). No accounts means there's no credential database to breach.

We can't protect a link you send over an insecure channel, a device that's already compromised with malware or a keylogger, a screenshot the recipient takes, or a weak passphrase. Anyone who holds the full link can read the paste — treat it like the secret itself.

Because the decryption key never reaches the server, a malicious or coerced operator gains nothing but opaque ciphertext. Rate limiting uses a keyed hash of the client IP, so even access logs don't reveal who created which paste.

There is no plaintext to subpoena. A lawful request can only ever obtain encrypted blobs and metadata like expiry timestamps — never readable content, because we don't have the key to produce it.

A coordinated disclosure process is planned. Until it's live, please report suspected vulnerabilities privately rather than publicly, and we'll acknowledge and credit responsible reports.