PrivateBin alternative: zero-knowledge comparison

The short answer

What actually differs

In short: if you want to self-host a proven, lean pastebin with zero-knowledge encryption, PrivateBin is a very good choice. Erseni Vault is worth a look if you want to request credentials from someone else rather than only send them, or if you do not want to run a server of your own.

Point by point

Every line states what each tool does, not just a tick or a cross. Where we are behind, it says so.

Criterion

PrivateBin

Erseni Vault

Encryption in the browser (zero knowledge)

PrivateBin Yes PrivateBin encrypts with AES-256-GCM in the browser, and the key sits in the URL fragment after the #, which never reaches the server.

Erseni Vault Yes AES-GCM-256 in the browser. The key lives in the URL fragment after the #, which browsers never send to a server, so Erseni only ever holds ciphertext. A note you add to a secret in the dashboard is stored in plain text instead; it labels the secret, it does not contain it.

Requesting a credential from someone

PrivateBin Not available PrivateBin works in one direction: you store something and share the link. There is no way to ask someone for an encrypted answer.

Erseni Vault Yes, end-to-end You create a request link for one specific person. Their browser generates a key pair locally (X25519) and encrypts the answer to it, so only you can read what they submit. They need no account and no software.

Secrets for AI agents

PrivateBin Only through third-party tools Community tools such as PBinCLI let a program create a paste from the command line. None of them can request a value from a person and bind it to a command.

Erseni Vault vault-ask and an MCP server An agent requests the value through a link, you enter it in your browser and see the command that will receive it. vault-ask passes it to exactly that command and masks it in its output; it never appears in the chat or the session log.

Usable without an account

PrivateBin Yes PrivateBin has no accounts at all, neither for creating nor for reading.

Erseni Vault Neither for sending nor for requesting Sending and requesting both work without signing up. A free account only adds the dashboard showing the status of your secrets.

One-time retrieval and expiry

PrivateBin As an option Burn after reading and expiry periods can be chosen per paste. Depending on the instance, never expiring is possible too, so one-time retrieval is not enforced.

Erseni Vault Yes, on first retrieval The first retrieval deletes the record in the same database operation that reads it, so a second attempt finds nothing.

Files

PrivateBin Depends on the instance File uploads with previews exist, but they are disabled in the default configuration and the operator sets the size limit.

Erseni Vault Limited Attachments are part of the Business tier, one file of up to 10 MB per secret.

Discussions on a paste

PrivateBin Yes Readers can comment under a paste, anonymously or with a nickname, and the comments are encrypted as well.

Erseni Vault No Erseni Vault is built for handing over a secret, not for conversations about it.

Open source and self-hostable

PrivateBin Yes, Zlib licence The source code is on GitHub, self-hosting is the intended way to run it, and with PHP and no database it is quickly done.

Erseni Vault Yes The cryptography component is published under the AGPL in a public mirror and can be self-hosted.

Maturity and adoption

PrivateBin Established for years PrivateBin grew out of ZeroBin, has been maintained for many years and runs on numerous public instances.

Erseni Vault Launched 2026, small project Erseni Vault is young, the user base is small and an external cryptography audit is still outstanding. If you need maximum operational maturity, factor that in.

Operator and hosting location

PrivateBin Depends on the instance There is no central service. Public instances are run by third parties in different locations; which one you trust with the code it serves is your call.

Erseni Vault Germany (Hetzner, Falkenstein) Servers and backups stay inside the European Union. The processors are listed individually at /subprocessors.

Where PrivateBin is the better choice

Be honest about the fit

You want to self-host and run a lean service without a database and without accounts.

Besides credentials you share code, logs or longer texts. That is what a pastebin is built for.

You want encrypted discussions underneath a shared text.

You want a project with a long history and many independent instances.

The one thing PrivateBin cannot do: ask for a credential

Requesting instead of sending

PrivateBin solves the half of the problem where you hold something and want to pass it on safely, and it does so with genuine encryption in the browser. Day to day the need often runs the other way: you need a login from a client or a colleague, ask by email, and the answer comes back in plaintext. With Erseni Vault you create a request link for that. The person's browser generates a key pair locally, encrypts what they type against it and sends us only ciphertext; you alone can decrypt it. If you never need that direction, PrivateBin is a fine tool to stay with.

Create a request link

How it works

Where these statements come from

Sources and limits of this comparison

We compare against public documentation and source code, and we say when we have not verified something ourselves. Products change: if a detail here matters to your decision, check it at the source before you rely on it.

PrivateBin on GitHub Describes AES-256-GCM encryption in the browser with the key in the URL fragment, expiry and burn after reading, password protection, discussions and file uploads that are disabled by default. The project itself names the limit that you have to trust an instance's operator with the code it serves.

Directory of public PrivateBin instances Public instances run by different operators.

PBinCLI A command-line tool from the community.