VoidPaste vs NullPaste
Both target privacy-first ephemeral pasting. VoidPaste adds owner accounts and scoped API keys; NullPaste leans harder into zero-account delete tokens.
This comparison sticks to documented, shipped VoidPaste behavior — no fake migration stats or features we do not run.
Create a VoidPaste · All alternatives · nullpaste.org
Side-by-side
| VoidPaste | NullPaste | |
|---|---|---|
| Primary job | Hosted ephemeral paste — expire, burn, privacy modes, optional client encryption | Privacy-first anonymous pastebin — expiry, burn, password, optional client AES |
| Account | Optional; anonymous create; accounts unlock private pastes, history, collections, versions | No accounts by design; API delete tokens for pastes created via API |
| Privacy | Public / unlisted / private / password; optional AES-256-GCM (fragment key) | Password (argon2id), burn, optional client AES-256-GCM with key in URL fragment |
| Expiration / burn | Presets, max views, burn-after-reading — API-enforced | Header expiry presets and burn-after-read with explicit confirm header |
| API / CLI | REST + Go CLI — REST /api/v1 with scoped keys + Go CLI | HTTP API without API keys (raw body create); headers for expiry/burn/password |
| Cost / limits | Free; 1 MB; rate limits; no paid plans | Free hosted; public docs cite ~1 MB and per-IP rate limits |
Choose VoidPaste when
- You want owner-private pastes and a signed-in history of what you created.
- You need scoped API keys and a Go CLI against a single production origin.
- You want collections and paste versions in one hosted product.
Choose NullPaste when
- You refuse accounts entirely and prefer delete tokens for API pastes.
- You want a curl-first API with no API-key ceremony.
- NullPaste’s threat model and operator docs match your workflow better.
Overlapping privacy toolkit
Feature lists look similar: burn, expiry, password, optional browser encryption. The split is product shape — VoidPaste is a hosted SaaS with optional identity; NullPaste optimizes for anonymous operation. Neither is a formal zero-knowledge compliance product; client encryption still means trusting the JavaScript the site serves.
Try it
Create a paste · Security model · Private & encrypted pastes