LibrePortal
Sponsor
Install

PrivateBin

Encrypted Pastebin

ProductivityWorks with 3 appsSeveral copies

PrivateBin is for passing someone a note, a password or a chunk of code as a link. The text is locked in your browser before it's sent, so even your own server can't read it, and the link can expire or delete itself after one look.

On this page
  1. At a glance
  2. What it's good for
  3. It needs HTTPS
  4. Making a paste
  5. Who can use it
  6. Good to know
  7. Addresses and ports
  8. Settings
  9. In its config file
  10. Works with
  11. Privacy and security
  12. What leaves this server
  13. What LibrePortal turns off
  14. Sources
  15. Under the hood

Good to know before you install

Pastes are encrypted in your browser, so the server never sees the text and cannot recover a lost link

At a glance#

What it is
Encrypted Pastebin Productivity
Where it opens
Web Interface On its own port at http://your-server:port, or paste.your-domain once you have a domain
Updates
Automatic A backup is taken first, and it rolls back if the update fails
Backups
Included Part of the daily backup when that's switched on
Copies
As many as you like Run several copies, each with its own data
Needs
HTTPS

What it's good for#

Sometimes you need to give someone a bit of text without it sitting in a chat history forever: the Wi-Fi password for a visitor, a recovery code, a config file you want a friend to look at. Paste it into PrivateBin, choose how long it should last, and send the link. When the time's up, it's gone.

What makes it different from an ordinary pastebin is where the encryption happens. Your browser encrypts the text before it leaves your device, and the key to open it is the part of the link after the #. Browsers never send that part to a server, so PrivateBin only ever stores scrambled text it has no way to read. Whoever has the full link can read the paste; nobody else can, including you as the server's owner.

PrivateBin or CryptPad?

CryptPad encrypts in the browser too, but it's a whole office suite for documents you keep and work on together. PrivateBin is for one-off text you hand over and forget.

It needs HTTPS#

The encryption uses a part of the browser that browsers only allow on secure pages: HTTPS, or a page opened on the same machine as localhost. On a plain http://192.168.1.50:5123 address the page loads, but PrivateBin can't encrypt anything, and it says so instead of making a paste. A VPN doesn't change that, because the browser only looks at the address.

That's why LibrePortal warns you before you install it without HTTPS, and why the app's Web Interface button shows a padlock and won't open while there's no HTTPS address for it. Either kind of HTTPS fixes it:

  • Without a domain, turn on HTTPS on your addresses. PrivateBin then opens at https://192.168.1.50:5123, once you've accepted LibrePortal's certificate on that device.
  • With a domain and Traefik, it answers at paste.your-domain with a certificate every browser trusts. That's the better choice if you'll be sending links to people outside your home, because they won't be asked about a certificate.

Making a paste#

There's no account and nothing to sign in to. Open PrivateBin, type or paste your text, and set the options above the box before you press Send:

  • Expires is how long it lives, a week unless you change it. Short is kinder.
  • Burn after reading deletes it the first time someone opens it. Good for passwords. Don't open the link yourself to check it, or your look may be the one it allows.
  • Password adds a second lock. Send the password by a different route from the link (a text message for the password, email for the link) and a leaked link alone is useless.
  • Open discussion lets readers leave comments under it, encrypted the same way.
  • Format chooses plain text, source code with highlighting, or Markdown.

Then copy the whole link, including everything after the #, and send it. File attachments are switched off, and a paste can be up to about 10 MB. LibrePortal runs PrivateBin with its standard settings, and there's nothing on its Config tab to change them.

Lose the link, lose the paste

Because the key only exists in the link, there's no way to get a paste back without it, not from the server, not from a backup, not by you as the admin. Keep the link until it's been read.

Who can use it#

Anyone who can reach PrivateBin can make pastes on it. That's what you want at home. On a public domain it means strangers who find the address could use your server to share their own text, and you'd have no way to see what it is. If only your household needs to make pastes, make it private; the catch is that people you send links to then can't open them unless they're in one of your trusted places.

Good to know#

  • Backups include the pastes, still encrypted, so a restore brings back pastes that haven't expired, but only for people who still have the links.
  • Expired pastes are deleted by PrivateBin itself.
  • Updates are automatic, with a backup taken first.
  • You can run several copies, each with its own pastes, though one does for most people.

Addresses and ports#

PrivateBin has one port. LibrePortal picks a free port number for each when you install, so yours will differ from anyone else's. The Config tab's Network section shows them, and the app's Open button uses the right one. "Anyone" means it's reachable from wherever your server is reachable; you can make it private later.

What it isWho can reach itWith a domain
Web Interface Anyone paste.your-domain

Settings#

In its config file#

PrivateBin's own settings aren't on the Config tab yet. They live in the app's config file, described here so you know they exist. How to change them.

SettingWhat it doesStarts as
Name
CFG_PRIVATEBIN_DISPLAY_NAME		 What this app is called on your dashboards. Leave empty to use its usual name Empty
Show on the LibrePortal Dashboard
CFG_PRIVATEBIN_SHOW_ON_DASHBOARD		 Whether this app gets a shortcut on the front page of the LibrePortal WebUI, separate from any Dashy dashboard
Choices: true, false		 true
Detailed logs
CFG_PRIVATEBIN_VERBOSE_LOGS		 Whether PrivateBin writes its normal, chattier logs, including who connected, instead of only warnings and errors.
Choices: true, false		 false
Debug logging for 24 hours
CFG_PRIVATEBIN_DEBUG_LOGS		 Turn on to see everything PrivateBin is doing while you look for a problem; it turns itself off after 24 hours.
Choices: true, false		 false

Works with#

These are the other apps PrivateBin knows how to work with. Once it's installed, its page shows the same list with whether each one is connected. How this works.

  • Grafana: Shows dashboards for the apps that have one. works with every app
  • Prometheus: Collects metrics from the apps that can export them. works with every app
  • Uptime Kuma: Watches your apps and shows when one goes down. works with every app

Privacy and security#

All clear PrivateBin is a private paste site where text is encrypted in your browser, so even the server cannot read it. It loads nothing from outside.

What leaves this server#

Nothing leaves this server on its own.

What LibrePortal turns off#

Nothing needed switching off.

Licence: zlib/libpng (from memory; permissive open source). Audited: 21 October 2026. See the privacy of every app and the Promise.

Sources#

Under the hood#

  • It runs this image: privatebin/nginx-fpm-alpine:2.1.0@sha256:0f80fb240c3c3073c53a82893da7c7d62f03f4e05403855b720e4371541ba412.
  • It can sit behind Authelia's sign-in once Authelia is installed.
  • Its own project and documentation: github.com/PrivateBin/PrivateBin

Ports, settings, tools and connections on this page are read from LibrePortal v0.10.97's app catalogue each time the guide is built.

Next steps

Every appAll the apps in the App Center, with search and categories.Several copiesRun two or more copies of one app, each with its own address.CryptPadEncrypted Office Suite