A pastebin for secrets. Share sensitive text between your own devices without ever trusting the server with a single readable byte.
AES-256-GCM · PBKDF2 · WEB CRYPTO
You know the moment: you need to move an API key, a config blob, or a wall of text from your laptop to your phone, and every easy option means pasting a secret into something you don't control. Hushbin is a named pad you open on both devices — type once, it appears on the other — but the server only ever holds ciphertext.
Every save is encrypted in the browser with AES-256-GCM before it goes anywhere. The pad's name is just its address; a separate passphrase is the key, and that passphrase never leaves your device. The server literally cannot read your pads — it's a dumb, encrypted mailbox.
The key is derived with PBKDF2 (100k iterations) via the native Web Crypto API, with a fresh random IV per save. Nice touches on top: version history (every save is immutable — browse, restore, or delete), syntax highlighting for JSON and XML, a privacy mode that blurs content while you screen-share, and light polling so a change on one device shows up on the other within seconds.
No accounts. The whole thing is a small Next.js app over raw SQL — deliberately boring where it counts, because the interesting part is the part I made sure I can't see.
Encrypt/decrypt happen in your browser via Web Crypto. The server stores ciphertext and an IV — nothing else.
Every save is a new version. Scroll the history, restore an old one, or delete what you no longer want around.
JSON/XML syntax highlighting, a privacy blur for screen-sharing, and 3-second polling so both devices stay in sync.
I spend my day job on systems that must degrade gracefully and never lose data. Hushbin is the opposite discipline: a system designed so that the operator — me — is deliberately blind. Zero-knowledge isn't a marketing word here; it's an architecture where the trust boundary sits at the edge of your browser, and everything past it assumes the server is hostile.
It started as a genuine itch — I kept needing to shuttle secrets between machines and hated every option. It turned into a tidy exercise in doing real cryptography with the platform's own primitives: no dependencies, no key ever on the wire, and a threat model I could explain in one sentence.
No sign-up. A pad exists the moment you name it; keep the name obscure (or let it generate one) and treat the passphrase like the password it is.