Zero-Knowledge AES-GCM Encrypted Paste
Data is encrypted directly in your browser using the native Web Crypto API. The encryption key and ciphertext live solely inside the URL hash fragment (#) and are never transmitted to our servers.
How Zero-Knowledge Web Crypto Works
Traditional pastebins store your unencrypted text in a database, making them targets for subpoenas, data breaches, and scraping bots.
UnixCorn's Zero-Knowledge Paste generates a fresh 256-bit AES key and a 12-byte random initialization vector (IV) directly in your browser.
The encrypted ciphertext and key are appended to the URL fragment identifier (#k=...&ct=...). Because browsers do not transmit URI fragments to HTTP servers, our servers only ever serve the static HTML/JS decryption application.
🔐 Mathematical Zero-Knowledge Architecture & Web Crypto Engineering
In an era of ubiquitous corporate telemetries and state surveillance, traditional pastebins expose sensitive code, SSH public keys, and infrastructure credentials to server logs and third-party database breaches. UnixCorn Zero-Paste enforces client-side cryptographic isolation where server operators have mathematically zero access to cleartext payloads.
Cryptographic Protocol Workflow
- 1. Key Generation: The browser generates a cryptographically secure 256-bit key using
crypto.subtle.generateKey(). - 2. AES-GCM Encrypt: The message is encrypted with a fresh 12-byte initialization vector (IV) producing ciphertext and a 128-bit authentication tag that guarantees data authenticity.
- 3. URL Hash Embedding: The payload and key are encoded in Base64URL and written into
window.location.hash. The server never receives this fragment.
❓ Zero-Knowledge Encryption FAQ
Frequently asked questions regarding Web Crypto API, AES-GCM-256 ciphers, and URL hash privacy.
How does UnixCorn.org guarantee zero-knowledge encryption?
UnixCorn.org implements the W3C standard Web Crypto API (window.crypto.subtle) directly inside your web browser. When you create a paste, a random 256-bit cryptographic key is generated client-side. Your text is encrypted using AES-GCM (Galois/Counter Mode) with a unique 96-bit initialization vector (IV). The encryption key is appended exclusively to the URL hash fragment (#key). Because web browsers never transmit the URL hash fragment to HTTP servers, UnixCorn servers receive zero bytes of plaintext data or decryption keys.
Why is the URL hash fragment (#) critical for client-side confidentiality?
According to RFC 3986, the fragment identifier of a URI (everything following the # symbol) is handled exclusively by the client user agent (your browser) and is never included in HTTP request headers sent across the network. Neither our Cloudflare edge servers, intermediate ISPs, nor DNS resolvers can ever view or log your decryption key.
What encryption cipher and key derivation standard is used?
We utilize AES-GCM-256 (Advanced Encryption Standard in Galois/Counter Mode with a 256-bit key length and 128-bit authentication tag). If you set an optional passphrase, the encryption key is derived using PBKDF2 (Password-Based Key Derivation Function 2) configured with HMAC-SHA-256, a cryptographically secure random salt, and 100,000 computation iterations to resist GPU-based brute-force attacks.
Can UnixCorn.org restore or decrypt a paste if I lose the URL?
No. By mathematical design, true zero-knowledge systems cannot be recovered. We do not store plaintext, and we do not hold private master keys. If you lose the full URL containing the hash fragment, the data is cryptographically unrecoverable.