Keep the goal narrow
Share one task-specific artifact: Encrypt in the browser and keep the key out of the server request.
Create an encrypted paste in your browser
Encrypted mode transforms readable text before upload using the browser Web Crypto API. Pastebin.ai stores ciphertext, while the decryption key remains after the # in the share URL and is not included in normal HTTP requests.
Encrypted sharing at a glance
Use these three checks before you turn encrypted sharing into a link for another person.
Start with the least exposure
Recommended first step: Enable client-side browser encryption
Remove risky details
Before upload: Review the encrypted sharing checklist below to replace live values while preserving the context a recipient needs.
Encrypted sharing tip: Security model adds this format-specific context: See what browser encryption protects and which metadata remains.
Encrypted sharing workflows
A well-scoped encrypted sharing artifact preserves the task-specific context below and can expire when that task ends.
Private notes
Encrypt locally, use a short expiration, and send the complete link through a trusted channel appropriate to the note’s sensitivity.
Internal snippets
Remove credentials first, then use encryption for code that is suitable to share but should not be readable in service storage.
Time-limited handoffs
Combine browser encryption with expiration when the recipient needs a temporary artifact rather than ongoing access.
Recommended paste settings
- 1Enable client-side browser encryption
- 2Choose the shortest useful expiration
- 3Keep the complete # fragment in the URL
- 4Verify the recipient can open a test paste
What not to include
Encryption does not secure a compromised device, unsafe browser extension, copied plaintext, or careless recipient. Credentials still belong in a dedicated secret-sharing system.
For encrypted sharing, a made-up but representative example is safer than a production export. Expiration can end future access to the source link, but it cannot recall a recipient’s copy.
Compare privacy controls →Use encryption when encrypted sharing must not be readable in storage
For a private encrypted sharing artifact, encrypted mode applies AES-GCM in the browser before upload. Its key stays after # in the share URL and outside the normal server request.
Understand client-side encryption →BEFORE UPLOADReadable content
→AES-GCM
IN STORAGEEncrypted bytes
Encrypted sharing questions
Practical answers about the access, retention, and context choices for encrypted sharing.
Can Pastebin.ai decrypt an encrypted paste?+
The application does not receive or store the fragment key in the normal request; decryption occurs in the recipient’s browser.
What happens if the URL fragment is lost?+
The ciphertext cannot be recovered through the service without the key, so preserve the complete link until the handoff is finished.