🔐 How PasteDB End-to-End Encryption Works

1. Account Setup

• A new RSA key pair is generated in your browser.
• A random KEK (Key Encryption Key) is generated.
• The KEK is encrypted using your RSA public key.
• The server stores:
  • RSA public key
  • Encrypted KEK
• The plaintext KEK is stored locally in IndexedDB as accountKEK.
• The RSA private key is also stored locally in IndexedDB so the browser can recover the KEK when needed.

Browser
 ├─ Generate RSA Key Pair
 ├─ Generate Account KEK
 ├─ Encrypt KEK with RSA Public Key
 ├─ Upload Public Key + Encrypted KEK
 ├─ Store RSA Private Key
 └─ Store accountKEK in IndexedDB

Encryption Modes

• Guest Users
  A random PEK encrypts the paste. The PEK is placed inside the URL fragment (#) so recipients can decrypt the paste locally. No account keys are required.


• Registered Users
  PasteDB generates an RSA key pair and an account KEK during registration. Each encrypted paste receives its own PEK. The PEK is encrypted with the account KEK before upload.

Supported Cryptography

• RSA-OAEP (4096-bit) — Encrypts the Account Key Encryption Key (KEK) during account setup.
• SHA-256 — Hash function used by the RSA-OAEP encryption scheme.
• AES-256-GCM — Encrypts paste titles, content, image URL arrays, and encrypts the PEK using the account KEK.
• Per-Paste Encryption Keys (PEK) — Every encrypted paste uses a newly generated random 256-bit AES key.
• Account Key Encryption Key (KEK) — A random symmetric key used to encrypt PEKs for registered users.
• Web Crypto API — All cryptographic operations are performed locally using the browser's native Web Crypto API.
• Cryptographically Secure Random Numbers — Keys and initialization vectors are generated using the browser's secure random number generator.

2. Creating an Encrypted Paste

• A random PEK (Paste Encryption Key) is generated.
• The PEK encrypts the paste title, content and images URL array.
• The PEK itself is encrypted with the account KEK.
• The server receives:
  • Encrypted title
  • Encrypted content
  • Encrypted images URL array
  • Encrypted PEK
  • Paste metadata

Generate PEK
      │
Encrypt Title / Content / Images URL
      │
Encrypt PEK using KEK
      │
Upload Everything

3. Why Metadata Isn't Encrypted

Only the title, content and images URL array are encrypted. Metadata remains readable because the server needs it to provide core functionality such as syntax highlighting, visibility rules, timestamps, ownership, expiration, searching and other application features.

4. Retrieving an Encrypted Paste

• Download encrypted paste.
• Load accountKEK from IndexedDB (or obtain the PEK from the URL fragment for guest/shared pastes).
• Registered users: Decrypt the encrypted PEK using the locally stored account KEK.
• Guest/shared pastes: Read the PEK from the URL fragment (#), then use it to decrypt the paste.
• Use the PEK to decrypt the title, content and images URL array.
• Display the plaintext in the browser.

Download Encrypted Paste
          │
     Registered?
     /          \
   Yes          No
   │            │
   |             \
  Load accountKEK  Read PEK from URL #
     │          │
Decrypt PEK     │
      \        /
       Use PEK
          │
Decrypt Title / Content / Images
          │
Display Paste

5. Sharing Unlisted Encrypted Pastes

For unlisted encrypted pastes, the PEK is appended to the URL fragment (#...). URL fragments are processed by the browser and are not sent to the server during HTTP requests.

https://pastedb.netlify.app/paste/abc123#PEK

What the Server Can See

• Metadata
• Encrypted title
• Encrypted content
• Encrypted images URL array
• Encrypted PEK
• RSA public key
• Encrypted Account KEK (for registered users)

What the Server Cannot See

• Plaintext title
• Plaintext content
• Plaintext URLs of images
• KEK
• PEK (unless intentionally shared through the URL fragment)
• RSA private key

Security Notes

• Encryption and decryption happen entirely in your browser.
• The server never receives plaintext encryption keys.
• Anyone with access to the URL fragment (#) can decrypt that shared encrypted paste.
• If local encryption keys are lost, encrypted data cannot be recovered.
• A fresh random 256-bit PEK is generated for every encrypted paste.

Summary

Your browser performs all encryption and decryption. PasteDB stores encrypted data and the metadata required for application features, but never has access to your plaintext title, content or images URL.