VOIDPASTE

VOIDPASTE

Share terminal output without the mess.

Paste. Protect. Share. Destroy.

No account required · ⌘/Ctrl + Enter to create · 1 MB anon · 5 MB signed in

Try an example:
0 chars0 B / 1 MB

Built to vanish on purpose

Logs, stack traces, and configs that should not live forever — with controls the API actually enforces.

Fast

Drop content, set options, get a URL. No account required for basic pastes.

Ephemeral

Expiration presets, max views, and burn-after-reading — enforced by the API.

Private

Unlisted, private, password, and optional client-side AES-256-GCM encryption.

Developer-first

REST API, scoped keys, raw endpoints, and a Go CLI against voidpaste.com.

Privacy modes, not slogans

Unlisted is secrecy-by-URL. Private is owner-only. Password is a paste password (argon2id). Client encryption means ciphertext only on the server — keys stay in the browser fragment or your password.

  • Password + optional client AES-256-GCM are distinct controls.
  • Expiration, max views, and burn are enforced atomically by the API.
Read the security model

Real workflows

Things people actually do with VoidPaste — not marketing personas.

  • Share a stack trace once

    Paste the log, set burn-after-reading or a short expiration, send the URL in chat — it won’t sit forever.

  • Pipe from scripts

    Create pastes with curl or the CLI against https://voidpaste.com using a scoped API key.

  • Encrypt before upload

    Turn on client-side encryption; only ciphertext hits the server. Keep the full #fragment URL.

  • Private to your account

    Sign in, set visibility to private — only your session or API key can read it.

API & CLI

Production origin https://voidpaste.com. Versioned routes under /api/v1/.

1curl -X POST "https://voidpaste.com/api/v1/pastes" \2  -H "Authorization: Bearer vp_live_..." \3  -H "Content-Type: application/json" \4  -d '{"content":"hello","visibility":"unlisted","expiration":"1d"}'
1go install github.com/fleames/voidpaste-cli/cmd/voidpaste@latest2 3voidpaste auth login --key vp_live_…4voidpaste create ./notes.md --expiration 1d
API docsCLI docs

FAQ

Honest answers from how VoidPaste actually works.

Do I need an account?
No. Anonymous paste creation is a core feature. Accounts unlock history, private pastes, collections, versions, and API keys.
What's the difference between unlisted and private?
Unlisted is secrecy-by-URL: anyone with the link can open it; it is not listed for discovery. Private requires you to be signed in as the owner (session or API key).
Is client-side encryption zero-knowledge?
When enabled, the server stores ciphertext only and never receives the fragment key. You still trust the JavaScript we serve — see /security for the full threat model. Lost keys cannot be recovered.
What does burn after reading actually do?
On the first successful view, the API marks the paste burned and returns the content once. Subsequent opens get gone/not found after cleanup. Share carefully — the first reader is the last.
Can I use VoidPaste from CI or scripts?
Yes. Use the REST API at https://voidpaste.com/api/v1 with scoped API keys, or the Go CLI (go install github.com/fleames/voidpaste-cli/cmd/voidpaste@latest). Raw content is also available at /raw/{id}.
Is VoidPaste free?
Yes. There are no paid plans. Anonymous pastes are limited to 1 MB (1,048,576 bytes); signed-in accounts and API keys allow 5 MB (5,242,880 bytes). Rate limits still apply as abuse controls.
Will secret detection catch everything?
No. Detection is best-effort and may warn on create for non-client-encrypted content. It is not a guarantee — review before you share.
How do email verification and password reset work?
We send transactional mail for account verification and password reset from [email protected]. Unverified accounts can sign in and read authorized content, but account writes require verification. Anonymous paste creation remains available under anonymous limits. Pastes themselves are never emailed.
Can I delete my account and pastes?
Yes. Dashboard → Security revokes your credentials and queues deletion of your profile and every owned paste/version. Historical encrypted backups are not rewritten; they expire under the published GFS schedule, and a pseudonymous tombstone prevents resurrection after restore. See /privacy for exact windows.