binthere

binthere encrypts each note in the browser with AES-256-GCM, so the server stores only ciphertext. The first reader gets the note, later requests get 410 Gone, and unread notes expire after 24 hours. It runs as one Cloudflare Worker with Static Assets, KV and a Durable Object.

binthere is a clean-room rebuild of PrivateBin's zero-knowledge model that uses Web Crypto and a strict content security policy. The browser generates a random 256-bit key before any network request, and the share link carries the note ID with the key after the #, a part of the URL browsers never send to a server. An optional password is mixed into the key derivation, so neither the link nor the password alone decrypts the note. A Durable Object makes the single read atomic, so if two people open the link at the same moment, only one gets the content. The viewer applies auto-detected syntax highlighting and renders a sanitized Markdown subset. The site has no accounts or analytics. For the terminal, the binthere npm CLI speaks the same protocol and works in pipelines such as git diff | npx binthere. Workers Static Assets serves the vanilla JavaScript frontend. A KV namespace stores normal pastes with native TTL expiry, a SQLite-backed Durable Object holds burn-after-read pastes, and a rate limiting binding throttles paste creation. SPEC.md freezes the protocol with test vectors, and SECURITY.md documents the threat model. The Deploy to Cloudflare button provisions the KV namespace, the Durable Object and the rate limiter.

Built for: Developers and small teams who share credentials or sensitive snippets and want a self-hosted, zero-knowledge one-time link service

What you can use it for

• Send a credential or API key to a teammate as a link that works once
• Share a private message or code snippet without either side signing up
• Pipe terminal output into a one-time encrypted link
• Host your own one-time secret-sharing service on your Cloudflare account

Deploy

• One-click · main path

  Branch main

  Deploy to Cloudflare

• CLI

  Paste the KV namespace id and preview_id that kv:create prints into wrangler.toml before you deploy.

  npm install
  npm run kv:create
  npm run deploy

  Copy

The button deploy asks for no secrets. Afterward, point the hardcoded canonical URLs, Open Graph image and security.txt at your own domain.

What it needs to run

• Durable ObjectsBurnPaste
• KV namespacesPASTES

Good to know

The server still sees IP addresses, timing and ciphertext sizes. Decryption runs in JavaScript served by the deployment, so a compromised host could leak keys. Lost links cannot be recovered. The UI fixes expiry at 24 hours and one-time view. The interface is English only. Passwords use PBKDF2-SHA256, and someone holding the link can test passwords offline.

Cost on Cloudflare

Where this comes from

• Repositoryhttps://github.com/nxfu/binthere
• App websitehttps://binthere.gaury.dev

An alternative to Onetime Secret, Password Pusher, Privnote, scrt.link.