Where is my paste stored?

Inside the URL itself, base64-encoded after the # symbol. Browsers do not transmit the URL fragment to servers, so even when the URL is requested over HTTP, the paste content stays on the client.

How does password protection work?

AES-256-GCM with a key derived from your password via PBKDF2 (200k iters, SHA-256) or Argon2id (64 MiB memory, 3 iterations). The encrypted blob plus a magic prefix indicating the KDF goes into the URL.

Why pick Argon2id over PBKDF2?

Argon2id is memory-hard, so attackers cannot brute-force it efficiently on GPUs or ASICs. The cost is about a second per derivation on a typical browser — a fair trade for high-value secrets.

How long can my paste be?

The URL must stay under ~64 KB for cross-browser reliability. That is roughly 45 KB of plaintext after base64/JSON expansion. Larger pastes are blocked with a clear error.

Will the link expire?

Not on its own — the URL is just data, not a database row. Local expiry purges the link from your saved list after the chosen interval, but anyone who copied the URL elsewhere still has it. For real ephemerality, use a separate transport with TTL.

لصق آمن

أنشئ لصقات مشفرة قابلة للمشاركة بدون خادم. المحتوى يعيش في عنوان URL.

كل شيء يعمل في متصفحك — بلا خادم وبلا تتبّع.