PrivateBin is a self-hosted, zero-knowledge pastebin web application. The PHP backend (Controller, Model, Data) handles paste/comment lifecycle, expiration, deletion, traffic limiting, and storage backend selection; the JavaScript frontend performs all encryption/decryption in the browser using AES-256-GCM (WebCrypto) with PBKDF2 key derivation and optional zlib/WASM compression. The server only ever stores ciphertext and metadata, never plaintext. Data flows from browser encryption into a pluggable persistence layer (filesystem, PDO database, Google Cloud Storage, S3), then back to the browser for decryption; JSON API endpoints accept and return encrypted bodies. Architecturally it is a classic server-rendered MVC app with a frontend state layer: index.php bootstraps a Controller, which delegates to Paste/Comment models over an AbstractData storage interface. Views are rendered via PHP templates with Bootstrap 3/5 themes, and the frontend is a vanilla-JS module namespace (PrivateBin) with submodules for encryption, editor, viewer, discussion, attachments, and i18n. The feature set includes expiration times, burn-after-reading, password-protected pastes, discussion threads, file attachments, URL shortening proxies (YOURLS/Shlink), QR codes, dark mode, and multi-language support. Engineering practices are strong for a mature open-source project: PHPUnit tests cover backend behavior, fast-check property tests cover frontend utilities, CI includes CodeQL/Snyk scans, and security hardening (DOMPurify, CSP, SRI hashes, HTTPS guidance) is explicit. Maintenance is active with recent commits and issue triage. Technical drift is moderate: the project retains legacy browser support and old Bootstrap 3/darkstrap assets, still supports PHP 7.4, and ships a monolithic JS file without a build step, but pinned frontend libraries (Bootstrap 5.3.8, Showdown 2.1.0, DOMPurify 3.4.17) are current.
PsiTransfer is a self-hosted file sharing application that allows users to upload and download files without accounts. It uses the tus resumable upload protocol for reliable large file transfers, supports password protection, one-time downloads, and archive downloads (zip/tar.gz). The backend is built with Node.js and Express, with a Vue.js frontend. The architecture is a monolith with a clear separation of concerns: an Express server handles routing, a file store manages disk I/O with path traversal protection, an in-memory database tracks metadata with garbage collection, and a custom tus protocol implementation (tusboy) handles resumable uploads. The codebase demonstrates good security practices (argon2 password hashing, input validation, safe filename handling) and is actively maintained with CI/CD, Docker support, and comprehensive tests.
Katbin is a pastebin service (pastebin/paste.rs-style) built on Cloudflare Workers with Hono, D1 (SQLite) via Drizzle ORM, and a Vite + React frontend styled with Tailwind CSS. It supports paste creation with syntax highlighting (highlight.js), markdown rendering, raw paste access, and configurable expiration. The service includes usage analytics with documented visitor limits, differentiated rate limiting (missing raw pastes are limited separately from existing ones), and admin routes that enforce authentication before executing any queries. Deployment is fully automated via GitHub Actions with separate production and staging environments, including D1 migration management through wrangler. The codebase demonstrates strong engineering practices: type-safe database access, careful analytics implementation with explicit visitor limit documentation, and security-conscious route design. The test suite covers API error handling, analytics edge cases, and rate limiting behavior.
MicroBin is a self-hosted pastebin and URL shortener implemented as a monolithic Rust web application using actix-web. It stores pastes (text, files, or URL redirects) in either SQLite (default) or a JSON file, with all state held in memory behind a single global Mutex. The application supports server-side and client-side AES encryption, expiration and burn-after-read limits, QR code generation, server-side syntax highlighting via syntect, multiple file attachments, and animal-name or hash-based opaque identifiers. It is configured entirely through CLI arguments or environment variables, and ships as a single static binary with templates and assets embedded via rust-embed and askama. The architecture is straightforward: actix-web route handlers in src/endpoints process HTTP requests, while src/util contains the database backends, encryption helpers, ID encoders, telemetry, and HTTP client construction. The system is designed for single-instance self-hosting with a small memory footprint. External dependencies include actix-web, rusqlite, askama, syntect, magic-crypt, and reqwest. A background telemetry thread posts anonymized configuration to api.microbin.eu every 24 hours unless disabled, and the admin panel checks for updates against the same API. Maintenance is active with recent commits, multi-platform release CI, and clippy analysis. Technical drift is medium: clap 3, env_logger 0.9, and askama 0.10 lag behind current major versions, and the CI pipeline uses deprecated actions-rs tooling and ::set-output syntax. The codebase has notable duplication (six near-identical auth handlers, repeated SQL schema definitions across every db_sqlite function) and a latent bug in the JSON database path where remove_expired calls delete(None, ...) which panics in JSON mode; the JSON path also hardcodes pasta_data/database.json instead of honoring the data_dir argument. The encryption scheme pads passwords with '#' instead of using a proper KDF, a design weakness for a security-focused feature.