Most pastebins store your text in plain form on their servers, which means anyone with access to the database — an employee, a hacker, or a court order — can read everything you've ever pasted. urlpaste works differently. When you create a paste, your browser encrypts it locally before anything is sent over the network. What reaches our servers is mathematically scrambled ciphertext, and the key to unscramble it never leaves your device. It travels only inside the link you share, in the part after the # that browsers never send to servers. The result: even if someone seized our entire infrastructure tomorrow, they'd find nothing but unreadable noise.
The encryption itself uses AES-256-GCM, the same battle-tested standard that protects banking apps and government communications — it scrambles your paste with a 256-bit key and detects any tampering. AES-256 is also quantum-resistant: even a large-scale quantum computer using Grover's algorithm would only reduce its effective strength to roughly 128 bits, which remains computationally infeasible to break. This matters because of "harvest now, decrypt later" attacks, where adversaries store encrypted data today and wait for future quantum computers. With a 256-bit key, your pastes stay safe not just today, but decades from now.
You don't need to understand any of the math to benefit from it. Everything happens automatically in your browser the moment you hit "create" — no plugins, no passwords to manage, no extra steps. The link you copy contains everything your recipient needs, and opening it decrypts the paste instantly on their device. We also support burn-after-read, so a paste can delete itself from our servers the moment it's viewed once. Our threat model is simple and honest: trust no one, not even us. That's why we've engineered ourselves out of the loop entirely.