An end-to-end encrypted pastebin that encrypts content in the browser using XChaCha20-Poly1305 and Argon2id before upload. The decryption key stays in the URL fragment and never reaches the server, with no opt-out: every paste is always encrypted.
Reviewed by Gabriel Bachmann
paaster
paaster.io No ratings yet. Be the first.
Rate paaster: No account needed
Threat level
Covered
A covered pick. Anyone can use it as a private drop-in, with no setup or know-how. Enough for most people. Threat levels
Our take
paaster takes the same zero-knowledge approach as PrivateBin but builds on more modern primitives: libsodium’s XChaCha20-Poly1305 secretstream with Argon2id key derivation, the same stack as VERNAM. Encryption is not a mode to enable. It is the only mode. Paste history, delete-after-view, and QR sharing are built in, and the project deliberately avoids dynamically loaded third-party scripts. It is a smaller, younger project than PrivateBin with fewer public instances; self-hosting is the most reliable path. A solid choice for anyone who wants the strongest available browser-side encryption on their pastes.
GitHub at a glance
WardPearce/paaster
Stars
549
+ 5 this week
Last commit
12d ago
healthy
License
AGPL-3.0
Latest release
v3.2.2
2mo ago
Stars, last 35d
Website at a glance
paaster.io
D score 35
Weak website security headers
Graded by Mozilla HTTP Observatory, tested 1d ago
Inspect this site yourself
Measures the security configuration of the tool's own website, not the privacy of the product itself. A strong tool can still score low here.
paaster alternatives
PrivacyNotes Zero-knowledge notes, tasks, files, passwords and journal secured by a single 12-word recovery phrase, with no email or password required. The crypto core and database schema are published for audit. No subscription model.
PrivateBin A minimalist open-source pastebin where the server has zero knowledge of pasted data. Content is encrypted and decrypted entirely in the browser using 256-bit AES-GCM before anything touches the server, with the decryption key stored only in the URL fragment.
paaster license, in plain English
AGPL-3.0 Strong copyleft · network
Free to use, even commercially. Changes must be published under the same license, and running a modified version as a network service counts as distributing it.
Permits
- Commercial use
- Modification
- Distribution
- Patent use
- Private use
Requires
- Disclose source
- Network use is distribution
- Same license
- State changes
- License and copyright notice
Does not provide
- Liability cover
- Warranty
Why it matters: The network clause is the point. Anyone who runs a modified version as a hosted service has to publish those changes, so the code handling your data stays inspectable. This is why privacy-first projects reach for AGPL.
Plain-language summary of the project's license, not legal advice. Read the full text for the exact terms.
* Average ratings will show on this page once the threshold of 5 ratings is reached.