fastpaste_

Security and privacy

What FastPaste keeps, for how long, and where it can’t protect you.

What we store, and for how long

  • What you share. Kept in memory on our server until it’s opened or expires, whichever comes first. That’s 10 minutes on the home page and at most 1 hour anywhere. Then it’s deleted and can’t be recovered, by you or by us.
  • What you send through Receive. Text and files, including file names, are encrypted on the sending device. The key is in the part of the QR link after the #, which browsers don’t send to a server, so we only hold data we can’t read. It’s deleted as soon as the receiving tab has it, or after 10 minutes.
  • Rate-limit counters. To stop abuse we count requests per network. The counter is keyed by a hash of your IP address with a random salt that changes every day, never the address itself. The counters reset at midnight UTC.
  • Daily totals. How many shares and opens happened each day, and how many bytes. No codes, no content, no addresses. Kept for 90 days.
  • Page views. Counted with Umami, which we run ourselves. It uses no cookies and doesn’t follow you to other sites.

What we don’t keep

  • A history of codes, or of who shared what with whom.
  • Your IP address.
  • Accounts, emails or names. There is nothing to sign up for.
  • Copies with third parties. Everything stays on our own server.

What FastPaste doesn’t protect against

  • Without a passphrase, we can read it. Plain shares travel over HTTPS but sit unencrypted on the server until they’re opened or expire. For passwords and keys, tick “Lock with a passphrase”: the text is then encrypted in your browser and the server never sees it or the passphrase.
  • Locked files aren’t encrypted. A file with a passphrase is only handed out to someone who knows it, but the file itself is stored as is.
  • Six digits can be guessed. There are a million codes. Each network can try 10 a minute, and a code only lives for minutes, so a random guess is very unlikely to hit yours. A passphrase makes a lucky guess useless.
  • Whoever opens it first gets it. Read the code to the right person. If they see “Code not found”, someone else may have opened it first. The sender sees when it was opened.
  • Whoever has a Receive QR code can send to that page. They can’t read what others send, but what arrives is only as trustworthy as the people who saw the code. Don’t open files you didn’t expect.
  • You have to trust the server. As with any hosted service, a compromised or dishonest server could keep what passes through it. Passphrase-locked text and anything sent through Receive are the exception, because they never reach us readable. That still relies on the page itself: a compromised server could hand your browser altered code.

Is it up right now? See the status page.