> What am I missing? The key part; the secret key is never sent to the server. http://stackoverflow.com/questions/14462218/is-the-url-fragment-identifier-sent-

> What am I missing? The key part; the secret key is never sent to the server. http://stackoverflow.com/questions/14462218/is-the-url-fragment-identifier-sent-to-the-server http://stackoverflow.com/questions/14462218/is-the-url-fragm... This was explained in safepaste's about page: -- The hash section of the URL, after the #, is never sent to the server; it's used only by the browser and safepaste takes advantage of that to store the secret key. -- Thus, the server cannot know the contents of the paste, since all encrypting/decrypting is done client-side. It's just a blob store for encrypted data. > There is no guarantee that the code running on the server is identical to the github repo. Agreed. That's why the whole paragraph you just quoted said you should run your own copy and verify it does what you want. That doesn't mean you should run your own for everyone else, it means you should run your own for you and those who trust you.