Most pastebins offer "private" or "unlisted" pastes. The label is misleading. It usually means the paste isn't listed publicly — but it's still stored in plaintext on the server, still readable by the provider, and often still accessible to anyone who guesses or finds the URL.
1. The server can read it. Plaintext storage means the provider — and anyone who compromises them — sees everything. 2. Search engines index it. "Unlisted" pastes frequently end up in search results because the URL is crawlable. 3. URLs leak. A "private" link shared in one chat gets forwarded, and the content is exposed.
True privacy means the server mathematically cannot read your content. That requires client-side encryption: the text is scrambled in your browser, and the key never reaches the server. Without that, "private" is just a UI label, not a security guarantee.
Ask one question: can the service reset my password and show me my pastes? If yes, they can read them — and so can anyone who breaches them. If the answer is no, you've found a genuinely private pastebin.
When a traditional pastebin offers a "private" or "unlisted" paste, the privacy is a UI convention, not a security property. "Unlisted" means the paste doesn't appear in public listings or search — but it's still stored in plaintext on the server, still readable by administrators, still returned to anyone who has (or guesses, or scrapes, or obtains from a log) the URL. Paste sites generate short, sequential, or low-entropy paste IDs; for years, researchers have enumerated them wholesale. A 2020 arXiv study ("Pastebin: A Haven for Malware?" and follow-on scraping research) demonstrated large-scale harvesting of public and unlisted pastes, surfacing thousands of leaked credentials, keys, and personal data. "Private" meant "not advertised" — nothing more.
Follow your plaintext paste after upload: it sits in the pastebin's database (readable by staff and subpoena); it passes through the platform's CDN/WAF (Cloudflare-class middleboxes terminate TLS); it appears in server access logs and application logs (often shipped to third-party observability platforms); it's indexed by link scanners and URL reputation services the moment anyone shares it anywhere; chat platforms unfurl it for previews; and the recipient's browser and OS may sync the visited URL to a cloud account. Each layer is an independent leak surface, and the paste content — plaintext — is exposed at all of them. With the average breach lifecycle at 258 days (IBM, 2024), plaintext at rest anywhere is plaintext waiting to be found.
True privacy requires the server to be incapable of reading your paste. That's the zero-knowledge design: the browser encrypts the content with AES-256-GCM before upload, and the key never touches the server because it lives in the URL fragment (#key), which browsers do not send in HTTP requests by design (it's stripped from the Referer header too). Now walk the exposure stack again: the database holds ciphertext; access logs show ciphertext IDs; CDN nodes relay ciphertext; link scanners fetch ciphertext without keys; chat unfurlers see an encrypted blob. Only the person holding the complete link — including the fragment — can decrypt. "Private" stops being a promise from the operator and becomes a property of the mathematics.
(1) Does the share link contain a # fragment? If not, the key went to the server (or there is no key). (2) Does the site offer burn-after-read with a claim the server can't read content? (3) Is the encryption documented (algorithm, where it runs) and ideally open-source? (4) Can you view-source and see the Web Crypto API call? Traditional pastebins — Pastebin itself, Gists, dpaste, controlc — fail at check #1. Zero-knowledge pastebins like Urlpaste and PrivateBin pass all four. If the answer to "can the operator read my paste?" is anything other than "mathematically no," the paste isn't private.
What does "unlisted" mean on Pastebin?
Only that the paste won't appear in public listings or search results. The paste is still stored in plaintext, readable by Pastebin staff, subject to legal process, and accessible to anyone with the URL — which appears in logs, referrer headers, and any chat or email where the link was shared. Unlisted is obscurity, not encryption.
Can someone guess or scrape unlisted paste URLs?
Yes, and it has been done at scale. Paste sites historically used short, sequential, or low-entropy IDs, and researchers have demonstrated wholesale enumeration that surfaced credentials, API keys, and personal data. Any model where the URL alone grants access to plaintext is enumerable by an attacker.
How does a zero-knowledge pastebin differ?
The paste is encrypted in your browser with AES-256-GCM before upload; the server stores only ciphertext, and the key travels in the URL fragment (#...), which browsers never send to servers. Whether the link is "public," "unlisted," or guessed by a scraper no longer matters — without the fragment, the content is undecryptable.