How does this compare to PrivateBin, which is free software?<a href="https:&#x2F;&#x2F;privatebin.info&#x2F;" rel="nofollow">https:&#x2F;&#x2F;privatebin.info&#x2F;</a>

Hi HN! I built hidetext.sh — a way to share text, code, and files through links the server can&#x27;t read.How it works: your browser generates a random key and encrypts everything locally (NaCl secretbox, XSalsa20-Poly1305). Only ciphertext is uploaded. The key goes into the URL fragment — the part after # — which browsers never send to servers. The link carries the key, my server stores the locked box, and the two only meet in a browser.A design detail I&#x27;m fairly happy with: burn-after-read doesn&#x27;t destroy the paste on the first HTTP request. The naive version means a Slack or iMessage link preview &quot;reads&quot; your paste before the recipient ever opens it. Instead, the reader&#x27;s tab sends a heartbeat, and the paste is deleted only once nobody is watching it anymore.Being upfront about the limits (full page at hidetext.sh&#x2F;how-it-works): you&#x27;re trusting the JavaScript I serve — inherent to any browser-based E2E tool; filenames are stored in plaintext (contents aren&#x27;t); and anyone holding the link can read the content, because the link is the key. No accounts, no cookies, no analytics, IPs aren&#x27;t stored.Stack: Next.js static on Cloudflare Pages, Pages Functions, D1 for metadata, R2 for encrypted blobs.It&#x27;s free. I&#x27;d love feedback — especially on the threat model and anything you&#x27;d expect from a tool like this that&#x27;s missing.

Show HN: Hidetext.sh – encrypted pastebin where the server never sees the key

Comments

jraph