Visibility is not confidentiality

Public and unlisted are discovery settings. An unlisted paste is harder to stumble across, but the URL itself grants access. Links can appear in browser history, chat logs, analytics, screenshots, and forwarded messages. Treat unlisted content as shareable, not secret.

Password protection

A password gate can reduce accidental access and offers a second channel for sharing the credential. Its strength depends on password quality, implementation, rate limiting, and how the server stores content. The server may still be technically able to read the underlying paste.

Related step: Pastebin.ai security model - Compare unlisted, passworded, owner-only, expiring, and encrypted modes.

Client-side encryption

With client-side encryption, readable content is transformed before upload. The server stores ciphertext. Pastebin.ai places the decryption key after the hash sign in the share URL; URL fragments remain in the browser and are not included in normal HTTP requests. The recipient’s browser uses that key to decrypt locally.

Know the remaining risks

Encryption does not protect a compromised device, a malicious browser extension, or a recipient who copies the content. Metadata such as creation time, size, and network address may still exist. Expiration helps minimize retention, while burn-after-reading trades recoverability for a smaller access window.

Key takeaways

  • Unlisted links are not confidential by themselves.
  • Client-side encryption keeps readable content off the server.
  • Share the link through a trusted channel.
  • Encryption cannot control what a recipient does after viewing.

Primary sources and further reading

  1. MDN Web Crypto API
  2. MDN URL fragment reference
  3. NIST Privacy Framework

Questions about Pastebin Privacy: Public, Unlisted, Passworded, or Encrypted?

Is an unlisted paste private?

No. It is omitted from public discovery, but anyone with the random URL can open it.

Can Pastebin.ai read passworded pastes?

A conventional password gate controls delivery while the stored content remains server-readable.

Can Pastebin.ai read encrypted pastes?

Encrypted mode uploads ciphertext and keeps the AES-GCM key in the URL fragment.

Does expiration erase recipient copies?

No. It ends future source-link access but cannot recall independent copies.

For more context on Pastebin Privacy: Public, Unlisted, Passworded, or Encrypted?, browse the complete Pastebin guide library or read the editorial policy behind this review.