The Problem

When you paste text into a normal pastebin, the server sees everything. The plaintext, the metadata, the IP, the timing. If the server is compromised, subpoenaed, or simply malicious, your text is exposed.

nullsec flips this model.

How nullsec Works

• Your browser generates an AES-256-GCM key

• Text is encrypted locally before leaving the device

• The server stores only ciphertext and an initialization vector

• The key lives in the URL fragment and is never sent over HTTP

If the database leaks, all anyone gets is encrypted noise.

Built for Deniability

No accounts. No cookies. No logs. No IP tracking.

Read-once mode deletes the paste after first decryption. Expiry ranges from 1 hour to 30 days. Cleanup runs automatically every 5 minutes.

The service cannot moderate, inspect, or recover your plaintext. That is the point.

Hardened

• Strict CSP with Trusted Types

• HSTS Preloaded — max-age 63072000

• Cross-Origin Isolation: COOP / COEP / CORP

• Permissions Policy: all sensors off

• DNS Prefetch Control: off

• Origin-Agent-Cluster: isolated

Verified

• Mozilla Observatory: A+ 155/100

• SecurityHeaders: A+

• SSL Labs: A+

• Sucuri: No malware

• Snyk: 0 issues

Try It

https://nullsec.pntr.dev

The server knows nothing. That's the whole idea.