How Secure Pastebin Works
Secure Pastebin uses cutting-edge post-quantum cryptography to protect your files. All encryption happens in your browser — we never see your files or passwords.
How It Works
When you upload a file, it's encrypted entirely on your device before being sent to our decentralized storage network. Here's the process:
- Select your file and enter a password — Your password never leaves your device.
- Key derivation with Argon2id — Your password is transformed into a cryptographic key using a memory-hard function that resists brute-force attacks.
- Hybrid encryption — Your file is encrypted using ML-KEM (Kyber) for key exchange and AES-256-GCM for content encryption.
- Upload to Shelby Network — Only the encrypted blob is uploaded to decentralized storage.
- Share the link — The decryption key is embedded in the URL fragment (#), which is never sent to any server.
Security Model
Our security model is built on the principle of zero knowledge. Even if our servers were completely compromised, your files would remain secure.
✅ What's Protected
- File contents — always encrypted
- File name — optionally encrypted
- Your password — never transmitted
- Decryption key — stays in URL fragment
🛡️ Protected Against
- Server breaches — encrypted data is useless without keys
- Man-in-the-middle attacks — key never in HTTP request
- Future quantum computers — post-quantum algorithms
- Brute force attacks — Argon2id is memory-hard
Why Post-Quantum Encryption?
Traditional encryption like RSA and elliptic curves will be broken when large-scale quantum computers become available. This creates a serious threat called "harvest now, decrypt later":
⚠️ The Threat: Adversaries can record encrypted data today and store it until quantum computers can break the encryption — potentially exposing secrets years or decades later.
We use ML-KEM (formerly Kyber), which was selected by NIST in 2024 as the primary post-quantum key encapsulation standard. It's based on lattice problems that are believed to be hard for both classical and quantum computers.
Privacy Guarantees
We believe in transparency about what we can and cannot access.
🚫 We Cannot See
- Your file contents
- Your file name (if metadata encryption enabled)
- Your password
- The decryption key
- Who accessed a specific file (no tracking)
👁️ We Can See
- Encrypted blob size
- Upload timestamp
- IP addresses (standard server logs)
- File expiration date
Note: Standard server logs may record IP addresses for security and abuse prevention. Consider using a VPN or Tor if IP privacy is important to you.
Technical Specifications
| Key Encapsulation | ML-KEM-768 (Kyber) |
| Symmetric Cipher | AES-256-GCM |
| Key Derivation | Argon2id |
| Argon2id Memory | 64 MB |
| Argon2id Iterations | 3 |
| Argon2id Parallelism | 1 |
| Salt Length | 32 bytes |
| Nonce Length | 12 bytes (96 bits) |