About NibbleStash

NibbleStash is a free, open source, zero-knowledge pastebin for sharing text, code, and notes securely. Everything is encrypted and decrypted inside your browser with 256-bit AES - so the server stores nothing it can actually read.

What is a zero-knowledge pastebin?

A traditional pastebin stores whatever you paste in plain text on a server, where administrators, hosting providers, or anyone who breaches the database can read it. NibbleStash works differently. When you create a paste, your content is encrypted in the browser before it ever leaves your device. The decryption key is placed in the part of the link after the # symbol, which browsers never send to the server. As a result, the only thing our servers ever hold is an unreadable block of ciphertext.

This is what "zero-knowledge" means: we have zero knowledge of what you share. We could not hand your data to a third party even if we were compelled to, because we simply do not possess the key to unlock it. Privacy isn't a policy promise here - it's enforced by mathematics.

How encryption works in NibbleStash

NibbleStash uses the Advanced Encryption Standard with a 256-bit key (AES-256-GCM), the same algorithm trusted by governments, banks, and security professionals worldwide. Encryption and decryption happen entirely client-side using your browser's built-in WebCrypto API. When you open a shared link, your browser reads the key from the URL fragment, fetches the ciphertext, and decrypts it locally. At no point does the readable version of your paste touch our infrastructure.

For extra protection you can add a password, which is combined with the URL key so that even someone holding the full link still cannot open the paste without the passphrase.

Features built for privacy

  • Burn after reading - the paste is permanently destroyed the moment it is opened, leaving no trace behind.
  • Automatic expiration - choose how long a paste lives, from a few minutes to much longer, after which it self-deletes.
  • Password protection - add a second layer of security on top of the encryption key.
  • Optional discussions - allow encrypted comments on a paste when you want a conversation around it.
  • Syntax highlighting and Markdown - share code and formatted notes that stay readable.
  • File attachments and QR codes - send files securely or share a paste quickly to a phone.

Open source and transparent

NibbleStash runs on PrivateBin, a mature and widely audited open source project. Because the entire codebase is public, anyone can inspect exactly how the encryption works and verify that our claims are true. We believe trust should be earned through transparency, not asked for on faith. There are no trackers selling your behaviour and no hidden analytics reading your content.

Who uses NibbleStash?

Developers share configuration files and code snippets without leaking secrets into third-party services. Journalists and their sources exchange sensitive information that needs to disappear after reading. IT teams pass credentials and logs securely. And everyday users simply share a note, a link, or a message they would rather keep between two people. If you have ever hesitated to paste something into an ordinary pastebin, NibbleStash was built for you.

Frequently asked questions

No. Your content is encrypted in your browser before it is uploaded, and the decryption key never reaches our servers. We only ever store ciphertext we cannot read, which is what makes NibbleStash a true zero-knowledge pastebin.

Yes. NibbleStash is completely free, requires no account, and is fully open source. There are no premium tiers, no paywalls, and no usage limits for normal sharing.

NibbleStash uses 256-bit AES encryption (AES-256-GCM) performed entirely in your browser through the WebCrypto API. This is the same encryption standard trusted by banks, governments, and security professionals worldwide.

The decryption key lives inside the link itself, after the # symbol. If you lose the full URL, the paste cannot be recovered by anyone, including us. We recommend saving important links somewhere safe before sharing.

You decide. Set an expiration time when you create a paste, ranging from a few minutes to much longer, after which it deletes itself automatically. You can also enable burn-after-reading so the paste is destroyed immediately after the first view.

No registration is required. Simply open the site, paste your content, choose your options, and share the generated link. We do not ask for an email address or any personal information.

Burn after reading is an option that permanently destroys a paste the moment it is first opened. It is ideal for sharing passwords, credentials, or one-time sensitive messages that should never be readable twice.

Yes. You can add a password when creating a paste. It is combined with the encryption key so that even someone who has the full link still cannot open the paste without knowing the passphrase.

Yes. NibbleStash runs on PrivateBin, a mature and widely reviewed open source project. Because the entire codebase is public, anyone can verify exactly how the encryption works rather than taking our word for it.

A normal pastebin stores your content in plain text, where staff, hosting providers, or attackers could read it. NibbleStash encrypts everything in your browser first, so the server only ever holds unreadable ciphertext. Your privacy is protected by encryption, not just by a privacy policy.

Yes, and it is one of the most common uses. For maximum safety, combine burn-after-reading with a password so the secret is destroyed after a single view and cannot be opened by anyone who only has the link.