paaster

---

Preview

---

Features

• End-to-end encryption
• Memory efficient
• File drag & drop
• Keyboard shortcuts
• Paste history
• Themes
• Delete after view or X amount of time
• Share via QR code
• Send to device
• CLI Tool
• i18n support (Contribute)
• Automatic or manual language detection
• No dynamically loaded 3rd party dependencies — malicious code must be present at build time
• Use of package-lock.json & Socket.dev to fight supply chain attacks

---

Documentation

See the documentation site for deployment, configuration, API reference, and architecture details.

---

Security

What is E2EE?

End-to-end encryption (E2EE) is a zero-trust encryption methodology. When you paste code into Paaster, it is encrypted locally in your browser using a secret that is never shared with the server. Only people you share the link with can view the paste.

FAQ

Can I trust an instance of Paaster not hosted by me?

No. Anyone could modify the functionality of Paaster to expose your secret key to the server. We recommend using an instance you host or trust.

How are client secrets stored?

Client secrets are stored in IndexedDB when the paste is created, allowing for paste history. This method of storage makes Paaster vulnerable to malicious JavaScript, but it would require malicious code to be present when the application is built.

How are client secrets transported?

Paaster uses URI fragments to transport secrets. According to the Mozilla Foundation, URI fragments aren’t meant to be sent to the server. Bitwarden also has an article covering this usage here.

How are server secrets stored?

Server secrets are stored in IndexedDB when the paste is created, allowing for modification or deletion of pastes later on.

---

Send to device

What is “Send to device”?

Send to device securely transfers the paste you’re viewing to another of your devices — for example, from your phone to your desktop — without manually copying the link.

When you click Send to device, Paaster generates a short-lived code that’s valid for 5 minutes. Enter that code on your other device, solve the captcha, and the paste is transferred directly. The transfer is protected with end-to-end encryption (crypto_box_seal), so the server never sees the paste’s contents or secret key.

---

Cipher

Paaster uses the following libsodium functions:

• crypto_secretstream_xchacha20poly1305_*
• crypto_pwhash
• crypto_secretbox_easy

These are implemented using the libsodium-wrappers-sumo library.

---

Requesting Features

• Open a new issue to request a feature (one issue per feature).

What we won’t add

• Paste editing — Paaster isn’t a text editor, it’s a pastebin.
• Paste button — Paaster isn’t a text editor. When code is inputted, it will always be automatically uploaded.
• Optional encryption — Paaster will never have opt-in/opt-out encryption. Encryption will always be present.

---

Support

Have any questions? Join our Matrix space.