Paaster is a secure and user-friendly pastebin application that prioritizes privacy and simplicity. With end-to-end encryption and paste history, Paaster ensures that your pasted code remains confidential and accessible.
Paaster is a secure and user-friendly pastebin application that prioritizes privacy and simplicity. With end-to-end encryption and paste history, Paaster ensures that your pasted code remains confidential and accessible.
package-lock.json
, poetry.lock
& Socket.dev to fight against supply chain attacks & vulnerabilities.End-to-end encryption (E2EE) is a zero-trust encryption methodology. When you paste code into Paaster, it is encrypted locally in your browser using a secret that is never shared with the server. Only people you share the link with can view the paste.
No. Anyone could modify the functionality of Paaster to expose your secret key to the server. We recommend using a instance you host or trust.
Client secrets are stored with IndexedDB when the paste is created, allowing for paste history. This method of storage makes Paaster vulnerable to malicious JavaScript, but it would require malicious code to be present when the Svelte application is built.
Paaster uses URI fragments to transport secrets, according to the Mozilla foundation URI fragments aren't meant to be sent to the server. Bitwarden also has a article covering this usage here.
Server secrets are stored with IndexedDB when the paste is created, allowing for modification or deletion of pastes later on. The server-sided secrets are generated using the Python secrets module and stored in the database using bcrypt hashing.
Paaster uses XChaCha20-Poly1305 encryption, which is implemented using the libsodium-wrappers library.
Ctrl+V
- Paste code.Ctrl+S
- Download code as file.Ctrl+A
- Copy all code to clipboard.Ctrl+X
- Copy URL to clipboard.NOTE: Latest MongoDB requires CPU with AVX support. If you're using virtual CPU (e.g. kvm64
) it will not work.
To fix that, either downgrade MongoDB to 4.x, or adjust your VM CPU configuration.
docker-compose.yml
(example here)sudo docker compose up -d
.env
file (example here)docker-compose.yml
(example here)sudo docker compose up -d
NOTE: the self-hosted version uses a temporary container (paaster-minio-init
) to create initial bucket
in MinIO container and configure it for public access.
Disable automatically via Vercel
Strict-Transport-Security: max-age=31536000
X-XSS-Protection: 1; mode=block
X-Frame-Options: DENY
Feature-Policy: microphone 'none'; camera 'none'; geolocation 'none'; payment 'none';
Paaster's frontend is also configured to work with Vercel, which offers enhanced security through server separation and improved performance.
Rclone is no longer supported for performance reasons & paaster is now only s3 compatible.
Look at Self-hosted S3 or Storage providers for cheap / free s3 storage.
This setup is not recommended & requires more research / knowledge.
git clone https://github.com/WardPearce/paaster
.cd frontend
.env
VITE_NAME
- The name displayed on the website.VITE_API_URL
- The URL of the API.npm install
npm run build
dist
with Nginx (or whatever reverse proxy you use.)cd backend
curl -sSL https://install.python-poetry.org | python3 -
run.py
following the guide for uvicorn.paaster_proxy_urls
.paaster_s3
.paaster_mongo
.paaster_open_api
.paaster_max_iv_size
.paaster_max_paste_size
.poetry run server
, to start server.Paaster uses Amazon S3 for storing large files, specifically, encrypted pastes. This allows us to save and share data quickly and easily through a Content Delivery Network (CDN). Some key advantages of using S3 are splitting data into smaller chunks, fast data sharing, and making copies of data for safety. The S3 buckets are expected to be publicly downloadable (they are end-to-end encrypted anyway), but the public directory listing should be disabled.
We use MongoDB for handling metadata information about each encrypted paste. It includes details like when the paste will expire, storage of access codes, initialization vector (IV) storage, and owner's secrets.