PrivateBin is a self-hosted, zero-knowledge pastebin web application. The PHP backend (Controller, Model, Data) handles paste/comment lifecycle, expiration, deletion, traffic limiting, and storage backend selection; the JavaScript frontend performs all encryption/decryption in the browser using AES-256-GCM (WebCrypto) with PBKDF2 key derivation and optional zlib/WASM compression. The server only ever stores ciphertext and metadata, never plaintext. Data flows from browser encryption into a pluggable persistence layer (filesystem, PDO database, Google Cloud Storage, S3), then back to the browser for decryption; JSON API endpoints accept and return encrypted bodies. Architecturally it is a classic server-rendered MVC app with a frontend state layer: index.php bootstraps a Controller, which delegates to Paste/Comment models over an AbstractData storage interface. Views are rendered via PHP templates with Bootstrap 3/5 themes, and the frontend is a vanilla-JS module namespace (PrivateBin) with submodules for encryption, editor, viewer, discussion, attachments, and i18n. The feature set includes expiration times, burn-after-reading, password-protected pastes, discussion threads, file attachments, URL shortening proxies (YOURLS/Shlink), QR codes, dark mode, and multi-language support. Engineering practices are strong for a mature open-source project: PHPUnit tests cover backend behavior, fast-check property tests cover frontend utilities, CI includes CodeQL/Snyk scans, and security hardening (DOMPurify, CSP, SRI hashes, HTTPS guidance) is explicit. Maintenance is active with recent commits and issue triage. Technical drift is moderate: the project retains legacy browser support and old Bootstrap 3/darkstrap assets, still supports PHP 7.4, and ships a monolithic JS file without a build step, but pinned frontend libraries (Bootstrap 5.3.8, Showdown 2.1.0, DOMPurify 3.4.17) are current.
MicroBin is a self-hosted pastebin and URL shortener implemented as a monolithic Rust web application using actix-web. It stores pastes (text, files, or URL redirects) in either SQLite (default) or a JSON file, with all state held in memory behind a single global Mutex. The application supports server-side and client-side AES encryption, expiration and burn-after-read limits, QR code generation, server-side syntax highlighting via syntect, multiple file attachments, and animal-name or hash-based opaque identifiers. It is configured entirely through CLI arguments or environment variables, and ships as a single static binary with templates and assets embedded via rust-embed and askama. The architecture is straightforward: actix-web route handlers in src/endpoints process HTTP requests, while src/util contains the database backends, encryption helpers, ID encoders, telemetry, and HTTP client construction. The system is designed for single-instance self-hosting with a small memory footprint. External dependencies include actix-web, rusqlite, askama, syntect, magic-crypt, and reqwest. A background telemetry thread posts anonymized configuration to api.microbin.eu every 24 hours unless disabled, and the admin panel checks for updates against the same API. Maintenance is active with recent commits, multi-platform release CI, and clippy analysis. Technical drift is medium: clap 3, env_logger 0.9, and askama 0.10 lag behind current major versions, and the CI pipeline uses deprecated actions-rs tooling and ::set-output syntax. The codebase has notable duplication (six near-identical auth handlers, repeated SQL schema definitions across every db_sqlite function) and a latent bug in the JSON database path where remove_expired calls delete(None, ...) which panics in JSON mode; the JSON path also hardcodes pasta_data/database.json instead of honoring the data_dir argument. The encryption scheme pads passwords with '#' instead of using a proper KDF, a design weakness for a security-focused feature.