This, done (more) right: zerobin [0] - open source, so you can (and should) host your own - encrypted on the client, only encrypted data is stored on the serve

This, done (more) right: zerobin [0] - open source, so you can (and should) host your own - encrypted on the client, only encrypted data is stored on the server. Key is "stored" in the fragment identifier [1] (ie after the #hash), so the server doesn't receive it, yet you can share the full url with who you want. Obvious deficiency: the javascript to encrypt/decrypt is distributed by the server, so you have to trust it. Which is why you should install and use your own instance. Side-effect of using client-side encryption: "burn after reading" is merely a convenience for the server admin so he can reclaim some disk space. You don't have to trust the server for this. Oh, and it's only php, so installation is only unzipping. [0] http://sebsauvage.net/wiki/doku.php?id=php:zerobin http://sebsauvage.net/wiki/doku.php?id=php:zerobin [1] https://en.wikipedia.org/wiki/Fragment_identifier https://en.wikipedia.org/wiki/Fragment_identifier