Paste it. Encrypt it. Let it burn.
Everything is encrypted in your browser before it leaves. Zero knowledge, by design.
🔒 the server never sees your content
Why cinderpaste?
Zero-knowledge
Your text is encrypted in your browser before it's sent. The server only ever holds ciphertext, so cinderpaste can't read, recover, or hand over your content.
Burn after reading
Turn on burn after reading and the paste is fetched and deleted in one atomic step. It can be opened exactly once — the second visit finds nothing.
No accounts, no logs
No sign-up, no cookies, no analytics, and no tracking. Create an encrypted link in seconds and share it anywhere, with nothing tying it back to you.
How it works
Type or paste your secret into the editor.
Pick an expiry and, if you like, burn after reading.
Share the one-time link — the key lives in the URL fragment.
The recipient's browser decrypts it locally.
Perfect for
Frequently asked
- Is cinderpaste really zero-knowledge?
- Yes. Your text is encrypted in your browser with AES-256-GCM before anything is sent. The server only ever stores ciphertext, a random IV, and (for password pastes) a salt. It never receives the plaintext or the key, so we genuinely cannot read your content.
- How is this different from Pastebin?
- Classic pastebins store your text in plaintext on their servers, which means the operator — and anyone who compromises them — can read it. cinderpaste encrypts everything client-side, adds burn after reading, and requires no account, so there's nothing readable to leak.
- Can I share passwords safely?
- That's one of the most common uses. Create a paste with the password, turn on burn after reading, and send the link. The recipient opens it once and the credential self-destructs, which is far safer than leaving it in chat or email history.
- What happens after a paste is destroyed?
- It's unrecoverable. A burned or expired paste is deleted from the database, and because the key was never stored server-side, there's no way to bring it back — not by us, and not by anyone who seizes the server.
- Do you keep logs?
- No content logs, no analytics, and no tracking cookies. Rate limiting uses a keyed hash of your IP address rather than the raw address, and that hash isn't tied to your pastes.