Pastebins & Snippets

Last reviewed Aug 26, 2026 · 429 words

The best self-hosted pastebins cannot read what you paste into them. PrivateBin, 0bin, and Cryptgeon all encrypt in the browser before anything reaches the server, so a compromised host leaks ciphertext and nothing else. That property splits the category cleanly: zero-knowledge tools for sharing text outward, and snippet managers for keeping code you will want back. Pick by which direction your text travels.

How to choose a pastebin

Share-and-forget or keep-and-search is the main axis. For sharing, you want encryption, expiry, and burn-after-reading: PrivateBin (8,569 stars, around since 2012) is the standard, Cryptgeon adds encrypted file attachments with no persistent database, and Password Pusher narrows the job to handing credentials over with view-count limits. For keeping, you want organization and history: Opengist stores every snippet as a Git repository with revisions and OAuth login — the natural self-hosted Gist replacement — while massCode is a local desktop snippet library with tags and full-text search, and ByteStash covers the multi-user web-app middle.

Second axis: what travels beyond text. MicroBin and Cryptgeon take file uploads; most of the others are text only.

Third axis: how you paste. Nearly everything here is browser-first, but fiche (written in C, 64 MB of RAM) accepts pastes piped over netcat straight from a terminal and prints back a short URL — no client, no browser, no accounts.

Where to start

MicroBin is the most tool per byte: one Rust binary doing pastes, file sharing, URL shortening, QR codes, and expiry in 128 MB of RAM. PrivateBin is the one to run when other people will use it, because its zero-knowledge design means you are never the custodian of their plaintext. Opengist is the one for developers who wanted a self-hosted GitHub Gist all along, revision history included.

An open pastebin is an offer to strangers

The classic mistake is leaving an instance anonymous and internet-facing. Public paste endpoints get discovered and then used — for spam, for malware distribution, for content you would rather not serve — and client-side encryption means you cannot even inspect what your server now hosts. Keep the instance behind authentication or a VPN, set aggressive default expiries, and treat "everything eventually deletes itself" as a feature rather than a limitation.

For a first-timer: PrivateBin in Docker, Easy-rated, expiry defaults dialed down to days. It has done one job well for 14 years, and the job it refuses to do — reading your pastes — is the point.