How Nobins works

Nobins is a zero-knowledge pastebin. Encryption and decryption happen entirely in your browser. The server only stores ciphertext — it can never read your content.

The flow

You write or paste content

Paste an incident note, onboarding handoff, recovery note, or any other text-only secret.

Browser encrypts client-side

The browser creates fresh key material and encrypts the note with XChaCha20-Poly1305 before upload.

Ciphertext is stored on the server

Only the encrypted blob is sent. The decryption key stays in the URL fragment, which the server never receives.

Recipient decrypts in browser

Opening the link reconstructs the key from the URL fragment and decrypts the content locally.

Security modes

open

X25519 + HKDF-SHA-256 + XChaCha20-Poly1305

Shorter links for everyday private notes, handoffs, and one-time instructions.

sealed

ML-KEM-1024 + X25519 + HKDF-SHA-256 + XChaCha20-Poly1305

Hybrid post-quantum envelope encryption for longer-lived recovery material.

Threat model

Server compromise: attacker gets ciphertext only, no keys.
Network interception: TLS + client-side encryption, double protection.
Quantum attacks: sealed mode adds an ML-KEM-1024 post-quantum layer.
Link sharing: anyone with the link can decrypt. Use burn-after-read for one-time access.