An end-to-end encrypted pastebin that encrypts content in the browser using XChaCha20-Poly1305 and Argon2id before upload. The decryption key stays in the URL fragment and never reaches the server, with no opt-out: every paste is always encrypted.
Reviewed by Gabriel Bachmann
paaster
paaster.io 1 rating so far*
Rate paaster: No account needed
Threat level
Covered
A covered pick. Anyone can use it as a private drop-in, with no setup or know-how. Enough for most people. Threat levels
Our take
paaster takes the same zero-knowledge approach as PrivateBin but builds on more modern primitives: libsodium’s XChaCha20-Poly1305 secretstream with Argon2id key derivation, the same stack as VERNAM. Encryption is not a mode to enable. It is the only mode. Paste history, delete-after-view, and QR sharing are built in, and the project deliberately avoids dynamically loaded third-party scripts. It is a smaller, younger project than PrivateBin with fewer public instances; self-hosting is the most reliable path. A solid choice for anyone who wants the strongest available browser-side encryption on their pastes.
GitHub at a glance
WardPearce/paaster AGPL-3.0 b2dockerdrivee2eeend-to-end-encryptionpaasterpastepastebinprivacypythonrclones3self-hostedstore
Stars
568
+0 this week
Forks
27
2 watching
Last commit
today
healthy
Latest release
v3.6.2
13d ago, 22 total
Star history
Issues
96% closed
3
open
65
closed
+1 / -0
opened / closed, last 4 weeks
Opened vs closed, last 12 weeks
Commits, last 26 weeks
195 commits, active 22 of 26 weeks
9 contributors since Mar 2022
Languages
- TypeScript 54.9%
- Svelte 37.9%
- CSS 6.4%
- Other 0.8%
Updated daily from the GitHub API. Star tracking since Jun 22, 2026.
Website at a glance
paaster.io
D score 35
Weak website security headers
Graded by Mozilla HTTP Observatory, tested 1d ago
Inspect this site yourself
Measures the security configuration of the tool's own website, not the privacy of the product itself. A strong tool can still score low here.
paaster alternatives
PrivacyNotes Encrypted notes, tasks, calendar, files, passwords and a journal with mood and medication tracking, all unlocked by one 12-word recovery phrase. Sign up with no email and no password. Open source.
PrivateBin A minimalist open-source pastebin where the server has zero knowledge of pasted data. Content is encrypted and decrypted entirely in the browser using 256-bit AES-GCM before anything touches the server, with the decryption key stored only in the URL fragment.
paaster license, in plain English
AGPL-3.0 Strong copyleft · network
Free to use, even commercially. Changes must be published under the same license, and running a modified version as a network service counts as distributing it.
Permits
- Commercial use
- Modification
- Distribution
- Patent use
- Private use
Requires
- Disclose source
- Network use is distribution
- Same license
- State changes
- License and copyright notice
Does not provide
- Liability cover
- Warranty
Why it matters: The network clause is the point. Anyone who runs a modified version as a hosted service has to publish those changes, so the code handling your data stays inspectable. This is why privacy-first projects reach for AGPL.
Plain-language summary of the project's license, not legal advice. Read the full text for the exact terms.
* Average ratings will show on this page once the threshold of 5 ratings is reached.