About MagicBin
A zero-knowledge encrypted pastebin. Built so that sharing sensitive text, keys, and code doesn't require trusting a stranger's server.
MagicBin is a pastebin with one core property: we are technically incapable of reading what you paste. Not because of a policy — because of math. Your content is encrypted in your browser before it ever touches our server, using AES-256-GCM, the same cipher used by governments and financial institutions worldwide.
The decryption key is embedded in the URL fragment — the part after the # symbol. Browsers never include the fragment in HTTP requests. Your key never travels to us. It lives only in the URL you share.
#key~… — browsers never include fragments in HTTP requests. Even your own network logs won't capture it.MagicBin is hosted on Canadian soil. Your encrypted data physically resides under Canadian jurisdiction, governed by Canadian federal law. However, all traffic passes through a US-based DNS and proxy provider before reaching our servers — meaning that provider observes IP addresses and request metadata at the network layer, subject to US law. Your paste contents remain encrypted end-to-end and unreadable to any third party, including the proxy.
The Personal Information Protection and Electronic Documents Act (PIPEDA) is Canada's federal private-sector privacy law, in force since 2001. It sets out 10 Fair Information Principles governing how organisations collect, use, and disclose personal information in commercial activity.
Canadian federal law (PIPEDA) governs data practices for MagicBin and supersedes provincial legislation. Questions can be directed to the Office of the Privacy Commissioner of Canada.
Our data footprint is minimal by architecture, not just by policy.
✓ What we store
| Data | Why |
|---|---|
| Encrypted ciphertext | The paste content — unreadable without your key |
| Initialisation vector (IV) | Required for AES-GCM decryption, not secret |
| Language hint | So the viewer knows which syntax highlighter to use |
| Expiry & view count | Enforces your chosen paste lifetime and view limits |
| Burn flag | Marks a paste for deletion after first read |
✗ What we never store
| Data | Why not |
|---|---|
| Decryption key | Lives only in your URL fragment — never sent to us |
| Plaintext content | Encrypted before leaving your browser |
| IP address | Not logged by this application — collected at the network layer by infrastructure providers |
| Browser fingerprint | Not collected |
| Account or identity | No accounts, no sign-up required |
| Cookies or analytics | Zero third-party scripts or trackers |
MagicBin is provided "as-is" without warranty of any kind, express or implied. While we have made every reasonable effort to implement strong encryption, secure infrastructure, and privacy-respecting architecture, no software system can guarantee absolute security or zero downtime.
We are not liable for any loss of data, inability to access a paste, or any damages arising from the use or inability to use this service. Pastes are ephemeral by design — always keep a copy of sensitive content in a secure location of your own if permanent retention is needed.
This service is intended for lawful purposes only. Do not use MagicBin to share content that is illegal, harmful, or violates the rights of others.