About - PasteBox

PasteBox is a small, self-hosted paste service for sharing text and code over a simple link. Paste something into the box on the home page, pick how it should be shared and how long it should live, then send the resulting URL to anyone you like.

Everything is rendered on the server and nothing is loaded from third-party services: the pages, styles, scripts and code-highlighting assets are all served from this host.

Create New Paste Browse the archive API reference

Who can read a paste?

Every paste has an exposure level. The level decides who the application lets read the paste and whether it appears in public listings.

Exposure	Who can read it	Listed publicly
Public	Anyone with the link, and anyone browsing the archive.	Yes. Shown on the home page and in the archive, and on the owner's profile.
Unlisted	Anyone who has the link.	No. Unlisted pastes are never listed anywhere; the link is the only way in.
Private	Only the signed-in owner.	No. Every other visitor receives a 403 error, even with the exact link.

Exposure is an access-control setting, not encryption - see "Can other people read my pastes?" below.

How long does a paste live?

Each paste can be given an expiry. When the time is up the paste is removed by the cleanup job and the link stops working; until then it behaves normally. Choose "Never" to keep a paste until you delete it yourself.

Never10 Minutes1 Hour1 Day1 Week2 Weeks1 Month6 Months1 Year

The API accepts the same options as short codes: N, 10M, 1H, 1D, 1W, 2W, 1M, 6M, 1Y.

Can a paste be password protected?

Yes. Any paste can be given an optional password (at least four characters). Readers who open a protected paste see a lock page first and have to enter the password before the content is shown; the unlock then lasts for their browser session. Passwords are stored only as salted hashes, never in plain text.

A password protects a paste on top of its exposure level. Raw links and API reads follow the same rules, so a locked paste stays unreadable until it has been unlocked.

What does "Burn after read" do?

Pastes marked "Burn after read" are deleted immediately after the first successful view by someone other than the owner - including opening the raw text or downloading the file. Use it for one-time secrets or single-use credentials. Opening your own paste does not consume it.

Do I need an account to paste?

No. Anyone can create a paste without registering, subject to the rate limits below. Guest pastes work like regular pastes, with three differences:

After creating a guest paste you are shown a one-time management link. It is the only way to delete that paste later, so save it: the link is displayed once and cannot be recovered.
Guest pastes cannot be edited - and neither can any other paste. PasteBox has no edit function. To change a paste, create a new one and delete the old one.
Guests cannot use the API. API keys belong to accounts.

What do I get with an account?

All of your pastes in one place, with view counts and one-click deletion.
Personal defaults for syntax and expiry, applied to every new paste.
An API key for the REST API - see the API reference. The key is shown, and can be regenerated, on your account page.
A public profile at /u/<username> that lists your public pastes.

Create an account Sign in

What are the current limits?

Paste creation is rate limited and every paste has a maximum size. The limits currently configured on this server are:

Limit	Value
Pastes as a guest	10 per hour, per IP address
Pastes with an account	60 per hour, per account
Maximum paste size	512 KB

Rate limits are checked before a paste is stored. When a limit is reached the service responds with HTTP 429 and a message asking you to try again later. Sign-in attempts are limited separately.

Can other people read my pastes?

Someone with access to this server - the operator - can read every paste in the database, including private and unlisted ones. The exposure setting controls what the application allows other users to see; it is not encryption and it does not hide anything from the operator.

Treat PasteBox like a shared server, not a private vault: do not paste passwords, private keys or other secrets you are not prepared to share with the operator.

For abuse prevention, guest pastes record a hash of the submitting IP address; the raw address is not stored.

Common questions

Can I edit a paste after creating it?

No. PasteBox pastes are immutable, like classic paste services. Create a new paste and delete the old one - guests delete through their management link, account holders from My Pastes.

What happens to my pastes if I delete my account?

Deleting an account also deletes every paste that belongs to it. This cannot be undone.

Who is shown as the author of a paste?

Pastes created while signed in show your username. Guest pastes are labelled "Guest". Private pastes are only visible to their owner in the first place.

Do views and raw downloads count as views?

The view counter increases for each normal page view by someone other than the owner. The raw and download endpoints do not increase it.

How do I use the API?

Create an account, copy your API key from the account page, then send it with each request in the X-API-Key header. The full endpoint reference, with example requests and error codes, is on the API reference page.