AES-256-GCM
Authenticated encryption via the Web Crypto API. Tampered ciphertext fails to decrypt, so altered content never renders.
Private text sharing by design
Your Text
meet me at midnight
What we Save
What you share
/······#
Security Overview
How we keep your text secure
Key never sent
The key lives in the URL fragment, after the #, which is stripped from every request, so it never reaches our servers.
Zero-knowledge server
We store ciphertext and an IV, never plaintext or keys. In the event of a data breach, your data is indecipherable.
Privacy First
No sign-up, no email, no profile
private by Design
The most secure way to share text online
What we store
- Encrypted ciphertext
- A random IV
- Expiry timestamp
What we never see
- Your plaintext
- The decryption key
- Your password
- Who you are
Security features
Add extra layers of security for your text
Password protection
Wraps the key with a PBKDF2-derived password key, protecting your text from unauthorized access if the link is exposed.
Burn after read
The paste is deleted in the same atomic step as the first read.
Automatic expiry
Choose a lifetime from one hour to thirty days.
Security Overview
How we handle harmful content
Not allowed
- Malware, ransomware, or phishing content
- Credential dumps or stolen secrets
- CSAM or content that exploits minors
- Harassment, doxxing, threats, or illegal content
Actions we may take
- Disable access to reported pastes
- Remove content that violates our guidelines
- Rate limit or block abusive traffic
- Preserve and share logs when legally required
See something that violates our guidelines?
You can create a report using the Report button in the paste toolbar. Reports can also be sent to abuse@textdrop.sh.
The details
Security FAQ
Is every paste zero-knowledge?+
Yes. Text is encrypted in your browser with AES-256-GCM before anything is sent. The decryption key is placed in the URL fragment (after the #), which browsers never include in HTTP requests. The server only ever receives ciphertext, so it cannot read your paste, with or without a password.
What happens if your database is breached?+
Nothing readable is exposed. Every stored record is AES-256-GCM ciphertext plus an IV. Without the key, which lives only in the URL fragment and never touches our servers, the data cannot be decrypted.
What does adding a password change?+
It protects against link theft or accidental exposure. The key is wrapped client-side with a PBKDF2-derived key before the link is built, so the URL alone is not enough to decrypt. Someone needs both the link and the password.
Responsible disclosure
security@textdrop.sh