Subscription Plans
Unlock password protection, custom view counts, and large payloads.
Free
Basic secure sharing for everyone.
- 50 KB max paste size
- 10 pastes per day
- Up to 24 hours expiry
- Up to 10 views
- Password protection
- Custom view limits
- Full syntax highlighting
- No ads
Pro Monthly
Unlock the full power of ScorchPad.
- 500 KB paste size (1 MB on Annual)
- 50/day · 150/day · Unlimited (Annual)
- Up to 90 days expiry (Annual)
- Custom views (1–9999) or Unlimited
- Password protection
- Custom view limits
- Full syntax highlighting
- No ads
Pro Half-Yearly
6-month plan for power users.
≈ ₹100/mo
- 500 KB paste size (1 MB on Annual)
- 50/day · 150/day · Unlimited (Annual)
- Up to 90 days expiry (Annual)
- Custom views (1–9999) or Unlimited
- Password protection
- Custom view limits
- Full syntax highlighting
- No ads
Pro Annual
Maximum storage, unlimited pastes.
≈ ₹83/mo
- 500 KB paste size (1 MB on Annual)
- 50/day · 150/day · Unlimited (Annual)
- Up to 90 days expiry (Annual)
- Custom views (1–9999) or Unlimited
- Password protection
- Custom view limits
- Full syntax highlighting
- No ads
Why ScorchPad
Every other pastebin can read your data.
Not a policy claim. An architectural fact. Here is exactly why ScorchPad is different — and why it matters.
Your server never sees the key
ScorchPad encrypts in your browser using AES-256-GCM before anything leaves your device. The decryption key lives exclusively in the URL fragment — a part of the URL that browsers never send to servers. Even with full database access, we literally cannot read your pastes.
PBKDF2 at 310,000 iterations — not theatre
Most tools that claim "password protection" store a hash server-side and decrypt for you. That's not zero-knowledge — that's just obfuscation. ScorchPad derives the encryption key from your password entirely in the browser using PBKDF2-SHA256 at the OWASP 2023 minimum. The server receives only a rate-limiting proof. Never the key.
The link self-destructs properly
After you decrypt a paste, ScorchPad erases the key from your browser URL using history.replaceState. It also auto-clears your clipboard 30 seconds after copying a share link. Burn-after-reading uses an atomic Redis Lua script — no race condition means no concurrent reads sneaking past the view limit.
HTML pastes run in a sandboxed iframe
If you share an HTML paste, ScorchPad renders it inside a fully sandboxed iframe with zero permissions. No scripts, no same-origin access, no cookie access. Pastebin renders HTML inline. That's an XSS vector. Ours isn't.
We publish a warrant canary
ScorchPad maintains a publicly accessible warrant canary — a signed statement updated monthly confirming we have not received secret government orders to compromise user data. If it ever stops updating, that's the signal. No other mainstream pastebin does this.
How We Compare
Feature by feature.
No marketing. Just what each tool actually does.
Comparison based on publicly documented features as of May 2026. "Partial" = feature exists but with meaningful limitations.
Start for free. Upgrade when you need it.
No credit card required. Free tier includes full zero-knowledge encryption — the same cryptographic guarantee as Pro.
Create Your First Paste