Pastebin links: what they are and whether they're safe

What a Pastebin link shows

Each paste gets its own address. When you open it, you see:

• the text someone pasted, in colour if it's code;
• a title, the author's name if they were signed in, and when it was posted;
• a hit counter, which Pastebin says counts unique visitors and tries to leave out bots;
• options to view the raw text on its own, which is handy for copying.

Who could find it depends on how the author saved it. Public pastes appear in the site's lists and can be indexed by search engines. Unlisted pastes are only seen by people who have the link. Private ones are only visible to the author. So if someone sent you a link, it's most likely public or unlisted.

Is it safe to click?

Opening a paste loads a text page from a well-known site. The usual dangers come after that. These are the red flags:

• Commands or scripts to run. Pastes are often used to share game scripts, terminal commands or "fixes". Running code you don't understand can hand over your account or your computer. If you can't read it, don't run it.
• Links to somewhere else. A paste can contain addresses that lead to a download or a login page. Check where a link goes before you open it.
• Requests for logins. A paste that asks you to sign in somewhere, "verify" an account or enter a code is a scam pattern.
• Pressure. The UK's National Cyber Security Centre lists authority, urgency, emotion and scarcity as tell-tale signs of a scam. A paste that says "do this now or lose your account" ticks two of them.

Check where a link in a paste goes

Before you open an address you found in a paste, put it into the redirect checker below. It follows the link the way a browser would and lists every hop, with its status code, and the final address. If a short link ends up on a download, an unfamiliar login page or a long chain of redirects, close the tab.

If you find your own information in a paste

Pastebin's acceptable use policy asks people not to post personal information, login details or financial data. If you find your own:

1. Change the password for any account it mentions, and anywhere else you used the same password.
2. Report the paste with the Report abuse button above it. Pastebin says it tries to handle removal requests within 24 hours.
3. Turn on two-step sign-in for the accounts affected.

Sharing text with a link yourself

If you want to send someone text with a link, think about who else might see it. Unlisted is the least you want for anything personal.

Liite's paste at liite.co/new is never listed publicly, and pastes made without an account are hidden from search engines. You can make a paste delete itself after one reading, or expire after an hour or a day. Links inside a paste made without an account show as plain text, so they can't hide behind other words. Links in pastes made with an account are clickable, and are checked against Google Safe Browsing when you save.

Related

• How to use Pastebin
• Telegram link not working