How I built an end-to-end encrypted pastebin (and why the server can’t read your text)

Short summary

Developer built hidetext.sh, a privacy-first pastebin that performs all encryption client-side using Web Crypto API—the server never sees plaintext, and the encryption key is stored in the URL fragment (never sent over the network). The post includes working implementation details and lessons learned, like handling burn-after-read race conditions, proving that complete server-side data blindness is technically achievable with modern browser APIs.

• •Client-side encryption via Web Crypto API; server sees only encrypted bytes
• •Key stored in URL fragment (#) stays client-side; server has no decryption access
• •Built working product (hidetext.sh) with optional burn-after-read and file/QR code support

Generated with AI, which can make mistakes.