Private pastes that can disappear

Share code that shouldn't live forever — with clear privacy modes, optional browser encryption, and burn-after-reading.

“Private paste” means different things on different sites. On VoidPaste it is a specific visibility mode plus optional extras. This page maps the modes to real behavior — see also the full security model.

Create a private or encrypted paste · Pastebin alternative hub

VoidPaste privacy modes

Mode	Who can open	Server plaintext?
Public	Anyone with the URL	Yes, unless also client-encrypted
Unlisted (default)	Anyone with the URL — secrecy by link	Yes, unless also client-encrypted
Private	Owner only (session or API key)	Yes, unless also client-encrypted
Password	Anyone who knows the paste password	Yes after password check, unless also client-encrypted
Client-encrypted	Same ACL as the base visibility, on ciphertext	Never — AES-256-GCM ciphertext only; key in URL fragment or derived from a password

Unlisted is not an ACL. Chat logs, browser history, and referrers can leak the link. Private requires authentication as the owner. Burn-after-reading destroys the paste on the first successful authorized view — share carefully.

Ephemeral controls

Expiration — presets from 10 minutes to 1 month, or never.
Max views — cap how many successful reads are allowed.
Burn after reading — first successful view marks the paste burned; later requests return gone/not found after cleanup.

These are enforced by the API, not just UI hints. Details: API docs.

vs PrivateBin

PrivateBin encrypts every paste in the browser by default and is typically self-hosted. That is the right model when you need an instance you operate and a threat model centered on “server never sees plaintext.” VoidPaste’s client encryption is optional and uses the same class of crypto (AES-256-GCM, fragment key) but you still trust our origin’s JavaScript — same class of caveat PrivateBin documents for any hosted instance. Prefer PrivateBin when self-hosting is a hard requirement; prefer VoidPaste when you want hosted expiry/burn, owner-private pastes, and API keys without running PHP/infra.

vs NullPaste

NullPaste also offers passwords, burn, expiry, and optional E2E encryption with no accounts. VoidPaste’s differentiator for “private” workflows is account-scoped private visibility and scoped API keys for automation. NullPaste’s API uses delete tokens and no key signup — better for purely anonymous curl pastes.

vs Pastebin / Gist “private” or “secret”

Pastebin private pastes require an account and stay on Pastebin’s servers in plaintext from the operator’s perspective — not client ZK.
GitHub secret gists are unlisted URLs tied to your GitHub identity; they persist and version. See VoidPaste vs Gist.

Practical recipes

One-time log for a teammate — unlisted + burn, or short expiration.
Password gate without accounts — visibility password; send the password out of band.
Ciphertext only on the server — enable client-side encryption; keep the full #fragment URL. Lost keys cannot be recovered.
Only you can read it later — sign in, set private; use an API key with pastes:read from scripts.

Create one

Open the editor, set visibility and options, then share the URL. Free — 1 MB max. CLI: docs/cli.