Open-source pastebin in 2026 (PrivateBin)

The short version

• PrivateBin is an open-source pastebin with about 8,400 GitHub stars, where the server never sees your text. It is encrypted in your browser before it is sent.
• Hosted paste services read what you paste. Pastebin, Privnote, hastebin, and a GitHub secret gist all keep your content in plain form on a server you do not control.
• A GitHub secret gist is not private. Anyone with the link can open it, it is not encrypted, and GitHub scans these gists for leaked credentials.
• DANIAN runs PrivateBin for €9 per month on an instance you control: no ads, no per-seat fees, daily off-site backups, and a 7-day free trial with no card.
• The honest trade: PrivateBin is for private, expiring shares, such as a config, a log snippet, or a one-time secret. It is not a code host or a snippet manager.

Why people are leaving hosted paste services in 2026

Hosted paste tools are convenient and mostly free, but your text sits readable on a server you do not control. Pastebin shows ads and a captcha, caps free pastes at 500 KB, and can delete pastes that go quiet. Privnote, hastebin, and GitHub gists store plaintext too. The 2026 shift is toward shares the host cannot read.

Four problems push teams off the hosted default. The first is noise: free tiers carry ads, captchas, and trackers around content you only wanted to share once. The second is a naming trick. A GitHub secret gist is not private — it is merely unlisted, and anyone who gets the URL can read it. GitHub now scans these gists for leaked secrets, which tells you how often credentials end up in them.

The third problem is quiet deletion. Pastebin can remove free pastes that stop getting traffic, so a link you shared last quarter may already be gone. The fourth is the one that matters most. The things people paste — API keys, server configs, error logs, database dumps — are exactly the things that should not become a third party's stored data. A paste is small, but it is rarely harmless.

What an alternative actually means here

An alternative is not just another website. You have three real paths: keep using a hosted service, self-host an open-source pastebin yourself, or have someone run one for you. Only one property changes the security model, and that is client-side encryption. When the server stores ciphertext it cannot read, the trust question changes entirely.

Here is what zero-knowledge looks like in plain terms. PrivateBin generates a random key in your browser. It encrypts your paste with 256-bit AES in Galois/Counter mode, the same family of cipher used across modern HTTPS. It then puts the key in the fragment of the link, the part after the # symbol. Because of how HTTP works, browsers never send that fragment to the server. The recipient's browser reads the key from the link and decrypts the paste locally. The operator, DANIAN included, only ever stores scrambled bytes. You can read the project's own description on privatebin.info and the source on GitHub.

That property is what separates the three paths. A hosted service reads your content. Self-hosting puts the data on a server you own, but you also own the patching, the certificate renewals, and the backup checks. Managed open-source keeps the ownership and hands the maintenance to someone else.

What teams actually share through it

The privacy point gets concrete fast. Think about the things you have pasted into a chat tool and later wished you had not. PrivateBin is built for exactly those, where a share should be read once and then disappear.

• A first password or onboarding credential, sent to a new hire and set to burn after reading.
• A configuration or .env file handed to one teammate during a deploy, set to expire that day.
• An error log or stack trace pasted for a colleague to read, then gone by the end of the week.
• A database connection string or API key given to a contractor for a single task.
• A webhook signing secret or token that should never sit in chat history.
• An internal note tied to one meeting, set to vanish once the meeting is over.

None of these belong in a permanent record. A chat message stays in history, and a hosted paste sits readable on a server you do not run. An encrypted, expiring share leaves nothing behind once its time is up.

How one share works, start to finish

A single example makes the model clear. Say you need to send a new contractor a one-time access key.

You open your PrivateBin instance and paste the key into the box. You set it to burn after reading, and to expire in one day as a backstop. You press send. The browser encrypts the key locally and returns a link, with the decryption key sitting after the # at the end. You copy that link into a direct message to the contractor.

They click it. Their browser reads the key from the link, decrypts the paste on their machine, and shows the access key. The moment they open it, the server deletes the stored copy. If the link leaks a week later, there is nothing left to read. At no point did your server, or DANIAN, hold anything but scrambled bytes.

What PrivateBin protects against, and what it does not

Client-side encryption is strong, but it is not magic. It helps to be precise about the threat it removes and the ones it does not. The honest version makes the tool easier to trust.

Take the protections first, because they are the reason to use it at all. A host who reads stored content sees only ciphertext. A database dump or a curious operator turns up nothing. A burned paste is gone after one read, so a link that leaks later opens nothing. Content that should not live forever does not, because expiry deletes it on schedule.

The limits matter just as much, so here they are plainly. The app runs in your browser, but the host serves that code. An operator who served modified code could, in principle, capture a key before encryption. That is the trust you place in any hosted zero-knowledge tool. It is why HTTPS and a trusted host both matter. Access logs are the second limit to keep in mind. The server can note that a share was retrieved, and the requesting address, while never seeing what was inside. The third limit lives on the endpoint itself. If the reader's machine is compromised, the paste is plaintext once it decrypts there.

The link is the key, in the most literal sense. Whoever has the complete URL can open the paste. The decryption key rides in the part after the # symbol. No login stands between that link and the content, since there are no accounts or per-person permissions. Treat the link like the secret it carries. Zero-knowledge raises the bar well above a plaintext host. It does not replace careful handling of the link itself.

There is a reason the operator-trust point is bearable. PrivateBin is open source, so its code can be read and checked by anyone. The encryption it uses is a public standard, not a private scheme. Self-hosting removes the operator from the picture, at the cost of the upkeep described later. On a managed instance, the trust shifts to a named operator running honest code over HTTPS. That is a smaller, clearer trust than handing plaintext to a service that reads it by design.

The shortlist: open-source paste tools worth knowing

PrivateBin is the pick for private sharing, with client-side encryption, burn-after-reading, an optional password, and file attachments. The self-hosted classics cover different jobs, and Nextcloud covers files rather than snippets. Below is what each tool is for, who built it, its license, and where DANIAN fits at €9 per month.

PrivateBin — encrypted, expiring pastes (the pick)

PrivateBin is a minimalist pastebin, forked from ZeroBin by Sebastien Sauvage in 2012 and now at about 8,400 stars under the permissive Zlib license. It encrypts every paste in your browser with 256-bit AES-GCM, supports passwords, burn-after-reading and timed expiry, drag-and-drop file and image attachments, and comments. The server holds only ciphertext. It suits a config, a log snippet, an error trace, or a one-time secret. The host cannot read any of them. DANIAN runs it as managed PrivateBin hosting for €9 per month.

haste and haste-server — fast, simple, not encrypted

haste is the open-source engine behind the public hastebin.com service, now maintained by Toptal, and written in Node.js for speed and simplicity. It stores pastes in plain text with no encryption, so it suits public code snippets rather than secrets. You self-host it yourself, and DANIAN does not manage it. If you need the host to be unable to read your shares, haste is not the right choice; PrivateBin is.

ZeroBin and 0bin — the encrypted lineage

ZeroBin, also by Sebastien Sauvage, pioneered the client-side-encrypted, key-in-the-link pastebin back in 2012, and PrivateBin is its actively maintained fork. 0bin is a separate Python re-implementation of the same idea. If you specifically want the originals, they exist, but in 2026 PrivateBin is the better-maintained path, with recent security fixes and current PHP support.

Nextcloud — when you need files, not snippets

For ongoing file sharing, shared folders, and document collaboration, a pastebin is the wrong tool, and Nextcloud is the open-source answer. DANIAN runs Nextcloud for file sharing at the same €9 per month flat rate. Use PrivateBin for ephemeral text and secrets you share and burn; use Nextcloud for files you keep and work on together.

See managed PrivateBin hosting →

How the options compare

The axis that matters is not price. It is whether the host can read your paste. Pastebin Pro is a cheap one-time fee, but Pastebin can still read your content. The table below compares each option on encryption, expiry, ads, who runs the server, and cost.

Read this honestly. Pastebin Pro is cheaper than €9 per month, because it is a one-time lifetime fee rather than a subscription. If price is the only axis, a free tool or Pastebin Pro wins. What €9 per month buys is different: the host cannot read your pastes, there are no ads or trackers, and it is one instance your whole team uses rather than a personal login.

The self-hosting column is the closer comparison. Running PrivateBin yourself means a production-class VPS at roughly $24 per month, plus your own time to keep it patched and backed up. The next section covers what that upkeep involves. The managed instance is €9 per month with that work handled, and you still own the data and pick the region.

Running PrivateBin yourself: the real maintenance

Self-hosting is a fair choice, so it helps to know what it asks of you. PrivateBin is a PHP application. It needs a web server, a PHP runtime, and a place to store pastes, either the filesystem or a database. Standing it up once is not the hard part. Keeping it healthy is.

Security fixes ship on a real cadence. Version 2.0.4 landed in May 2026 and addressed issues from the prior release. Staying current is your job, and a pastebin holding secrets is a poor place to fall behind. You also install and renew the TLS certificate, because the encryption model assumes the connection itself is sound.

Two more tasks are easy to forget. Backups need to run, and they need to be restored at least once, since a backup you have never tested is only a hope. And because anyone who can reach the instance can write to it, you set rate limits and spam controls, or you wake up to junk pastes. None of this is difficult on its own. All of it recurs.

On a managed instance, that recurring work is handled for you. Updates and daily off-site backups come with the €9 per month, along with monitoring, and you still own the data and choose the region. The trade is plain. Pay a flat monthly fee, or pay with your own time.

Start a 7-day free trial — no card

How to pick: three questions

Three questions decide it. Does the host need to be unable to read your shares? Will your whole team use this, or just you occasionally? Do you want to run the server yourself, or have it run for you? Your answers point at one row in the table above.

First, does the server need to be blind to your content? If you share secrets, configs, or internal logs, you need client-side encryption, which means PrivateBin rather than Pastebin or a gist. Second, is this for a team or one person? A team that shares often is worth a flat €9-per-month owned instance. A solo developer pasting once a month is fine on a free tool. Third, do you want to run it yourself? If you enjoy patching PHP and renewing certificates, self-host. If not, DANIAN runs it for €9 per month.

Switching from Pastebin without losing anything

Leaving Pastebin is less work than a normal migration, because there is nothing to export. Pastes are short-lived by design, so you are changing where new ones go, not moving an archive. That distinction makes the switch an afternoon rather than a project.

Your old Pastebin links keep working until they expire or you delete them. Nothing breaks on the day you move. There is no database to port and no proprietary format to escape. You point people at the new instance and start sharing there. The only thing that has to change is the habit of reaching for the old site.

Be deliberate about what moves and what stays. Anything private belongs on the new instance: configs, logs, one-time credentials, internal notes. Public snippets can stay on a free tool if you like. The kind you would paste into a forum answer have no secret to protect. Drawing that line once stops the new instance from filling up with throwaway text.

Expect a few Pastebin habits to change when you switch. PrivateBin keeps syntax highlighting and a few display formats, so code still reads as code. What it does not keep is an account with a history of everything you posted. That history is exactly the stored record the tool is built to avoid. Maybe you relied on Pastebin as a personal archive of snippets. That is a sign you want a snippet manager or a notes app, not a private pastebin. Knowing that before you switch saves a wrong-tool moment later.

The hard part is not technical at all. It is getting a team to reach for the private link by default. The familiar old site is what you are competing with. Put the link where people look first, and name it in your onboarding notes. The new default takes hold within a week or two, and the old habit fades on its own.

Frequently asked questions

How it works and what it is

What is PrivateBin?
PrivateBin is a minimalist open-source pastebin, forked from ZeroBin in 2012 and now at about 8,400 GitHub stars under the permissive Zlib license. You paste text or code, set an expiry, and share a link. The difference from Pastebin is that the server never sees your content in readable form.

What does zero-knowledge mean for a paste?
Zero-knowledge means the server stores your paste but cannot read it. PrivateBin encrypts the text in your browser before anything is sent, using 256-bit AES-GCM. The decryption key lives in the part of the link after the # symbol, which browsers never send to the server. The host only ever holds scrambled bytes.

Is PrivateBin really encrypted, or just unlisted?
It is genuinely encrypted, not merely hidden. Encryption happens in your browser with a key the server never receives, so a host with full database access still sees only ciphertext. That is different from an unlisted link, where the content sits in plain form and anyone who gets the URL can read it.

Can PrivateBin share files and images, or only text?
Both. Alongside text and code, PrivateBin supports drag-and-drop file and image attachments, optional passwords, comments, and QR codes for opening a paste on a phone. Attachments are encrypted in the browser the same way the text is, so the server cannot read them either. It stays a sharing tool, not a file store.

What is burn-after-reading?
Burn-after-reading deletes a paste the moment it is first opened, so a one-time secret cannot be read twice. PrivateBin also offers timed expiry, from five minutes up to a year or longer, set per paste. You choose how long a share lives, rather than leaving it on a server forever.

How it compares to hosted services

How is this different from a secret GitHub gist?
A secret gist is not private. GitHub itself states that anyone with the link can open a secret gist, and it is stored in plain text, not encrypted. GitHub even scans secret gists for leaked credentials. PrivateBin encrypts in the browser, so the link alone is not enough to read a paste without the key in it.

How is this different from Pastebin Pro?
Pastebin Pro removes ads and raises limits, but it does not encrypt your pastes. Pastebin can still read what you post, and a Pro account is a personal login rather than a shared instance. PrivateBin encrypts client-side and runs as one instance your whole team uses. The win is privacy and ownership, not a lower price.

Is Privnote not already private enough?
Privnote deletes a note after it is read, which is useful, but the note still passes through Privnote servers and Privnote is not a zero-knowledge open-source instance you control. With PrivateBin on your own host, the operator only ever holds ciphertext, and you decide retention, expiry, and where the server lives.

Do I need to migrate my old pastes?
No migration is needed, because pastes are meant to be short-lived. There is no archive to move: you point your team at the new PrivateBin link and start sharing there. Old links on Pastebin or hastebin keep working until they expire, so nothing breaks on the day you switch.

Cost, data, and control

What does it cost to run PrivateBin on DANIAN?
It costs 9 euros per month, flat, for one managed instance. That includes one compute unit, 30 GB of storage, 1,000 GB of monthly traffic, automatic updates, daily off-site backups, and chat support. There are no per-seat fees, so the whole team shares one price. A 7-day free trial needs no card.

Is 9 euros a month worth it when Pastebin Pro is a one-time fee?
If price is your only concern, a free tool or Pastebin Pro, a one-time lifetime fee near 49.95 dollars, is cheaper. The 9 euros per month buys three things they do not: the host cannot read your shares, there are no ads or trackers, and it is one owned instance for the whole team rather than a personal account.

Who can read my pastes on a DANIAN-hosted PrivateBin?
Only someone holding the full link, including the key after the # symbol, can read a paste. DANIAN stores ciphertext it cannot decrypt. The honest caveat is the same for any hosted instance: you trust the operator to serve the unmodified app over HTTPS, and access logs can show that a paste was opened, though not its contents.

What happens to my data if I leave?
You keep control because it is your instance, not a locked account. PrivateBin runs on standard PHP with a filesystem or database store, so an export or a server move is straightforward, and there is no proprietary format to escape. Cancel whenever you like; the 7-day trial and monthly billing mean you are never tied in.

Can I use my own domain?
Yes. A DANIAN-hosted PrivateBin can run on your own domain or subdomain, such as paste.yourcompany.com, so shared links carry your name rather than a third party. You can choose the datacenter region from 21 locations across six continents, putting the instance near the people who use it.

Limits and fit

When is PrivateBin the wrong choice?
PrivateBin is the wrong tool for public throwaway snippets, for code review with version history, or for a solo developer who pastes once a month. For those, a free hosted service or a gist is fine. PrivateBin earns its place when shares must stay private and a team uses it often enough to want an owned instance.

What are PrivateBin's real limitations?
PrivateBin is a focused sharing tool, not a code host or snippet manager, and it has no built-in user accounts or fine-grained access control. You must trust the operator and use HTTPS, and access logs reveal that a paste was opened. It encrypts content, but metadata about access can still exist. Plan around those limits.

Do I still need Nextcloud as well?
For files you keep, yes. PrivateBin is built for ephemeral text and one-time secrets, not for shared folders, document collaboration, or long-term storage. Nextcloud is the open-source answer for that, and DANIAN runs it at the same 9 euros per month. Use PrivateBin to share and burn; use Nextcloud to store and collaborate.

Rolling it out with a small team

Getting a team onto a private pastebin takes an afternoon, not a project. The point is to make the private option the easy one, so people reach for it by default instead of pasting a secret into chat.

Put the instance on a subdomain of your own, such as paste.yourcompany.com, so the link reads as yours. Set a sensible default expiry, a day or a week, so old shares clear themselves out. Agree on what flows through it: one-time secrets and short-lived snippets, rather than documents you mean to keep.

One habit matters more than the rest. Send the link in a direct message, not a public channel, because the decryption key is part of the link. For a shared instance, an optional instance password adds a second gate before anyone reaches the paste form at all. After that, it mostly runs itself.

What to do this week

If you regularly share text the host should not read, start with one PrivateBin instance and move your team's secret-sharing onto it. DANIAN runs it for €9 per month with a 7-day free trial and no card. Keep Nextcloud in mind for the files you keep rather than burn.

The first step is small. Spin up one instance, put it on a subdomain like paste.yourcompany.com, and share the next config or one-time secret through it instead of Pastebin. From €9 per month, no per-seat fees, with a 7-day free trial and no card, the cost of trying it is a week of your time, not a budget line.

See Nextcloud for file sharing →