🔒 Setup PrivateBin — Self-Hosted Zero-Knowledge Encrypted Pastebin

Overview

PrivateBin is a minimalist, open-source, zero-knowledge encrypted pastebin. The defining principle is that the server never has access to the content of pastes — all encryption and decryption happens in the browser using AES-256-GCM. The symmetric encryption key is stored only in the URL fragment (#key) which browsers never send to the server. This means even if the server is compromised, the paste content remains unreadable. PrivateBin requires no database by default — it stores encrypted paste blobs as flat files in the data/ directory. Features include burn-after-reading, configurable expiry (5 minutes to 1 year), syntax highlighting via Prettify, Markdown rendering, password protection, and discussion threads on pastes.

Why Use It

Pastebin.com, GitHub Gist, and similar public paste services store your content in plaintext on their servers — anyone with the URL can read it, and the service provider can scan content. PrivateBin ensures that even you as the server operator cannot read paste content without the key. For sharing sensitive configuration snippets, API keys during onboarding, temporary credentials, or private text with clients, zero-knowledge encryption provides a fundamentally stronger privacy guarantee than any server-access-controlled alternative.

When You Need It

Who Should Use It

Real Use Cases

Main Features

How to Use After Installation

Security Best Practices

Ports and Firewall Notes

PrivateBin uses port 8080. For production, always serve over HTTPS via Nginx Proxy Manager — sharing paste URLs over plain HTTP exposes the encrypted ciphertext in transit (though not the key, the ciphertext should stay private). Restrict direct port 8080 access with ufw and only expose via the HTTPS reverse proxy.

Backup and Maintenance

Common Mistakes

Troubleshooting

Alternatives

Hastebin is a simpler, non-encrypted pastebin for quick text sharing without privacy requirements. Pasty is a modern alternative with API support. For file sharing (not just text), Pingvin Share or SFTPGo provide file drop functionality. CryptPad provides zero-knowledge encrypted collaborative editing for more complex documents beyond single pastes.

When Not to Use It

PrivateBin is not a file sharing tool — it is limited to text pastes. For sharing binary files, use Pingvin Share or similar. PrivateBin's burn-after-reading is not suitable for content that needs to be accessed multiple times. The zero-knowledge model means if the sender loses the URL, the content cannot be recovered from the server — it is truly inaccessible without the key fragment.