BitVault

A self-hosted pastebin, file drop and URL shortener. Every paste lives at three BIP39 words, such as /happy-apple-banana. One static binary, SQLite, no telemetry.

• Text, files and short links, with syntax highlighting, QR codes and a REST API.
• Privacy levels: public, unlisted and read-only (not encrypted; read-only cannot be changed or deleted by its readers), private (encrypted on the server) and secret (encrypted in your browser, so the server never sees the key).
• Expiry, burn after reading, optional editing and one optional admin.

BitVault is a maintained fork of Microbin. Version 2026.11.0 is a rewrite with no compatibility with 1.6.0 data, URLs, configuration or API; see the changelog.

Install

Download the offline bundle for your CPU from the latest release, then:

sh install.sh --archive bitvault-<version>-x86_64-unknown-linux-musl-offline.tar.gz            # ~/.local/bin
sh install.sh --archive bitvault-<version>-x86_64-unknown-linux-musl-offline.tar.gz --system  # as root: systemd service

The installer works offline, checks the bundle for damage and never calls sudo itself. Add --sha256 <checksum> from the release's SHA256SUMS to refuse an altered bundle. AIRGAP.md covers TLS, secrets and building without network.

Run behind nginx

BitVault listens on 127.0.0.1:8080 and expects a reverse proxy to terminate TLS. Use deploy/nginx.conf (it is also in the bundle) and set public_url to the address users type. Uploads stream through nginx, so keep client_max_body_size at max_file_mb plus one.

Plain HTTP on a private network

Set insecure_http = true to serve plain HTTP without a proxy, for example on 0.0.0.0:8080 in a home network: any host name is answered and addresses follow the one in the browser. Secret pastes are unavailable, because browsers only encrypt on https pages. Passwords and pastes then cross the network unencrypted, any web page can reach the instance through DNS rebinding because every host name is answered, and cross-site posts without cookies are not blocked, so never use it on a network you do not trust.

Configuration

Copy config.example.toml and pass it with --config. Every key is optional and documented there. Environment variables override the file as BITVAULT__SECTION__KEY, and a _FILE suffix reads a secret from a file.

API

The API needs no key. Browse it at /docs on your instance, or fetch /api/v1/openapi.json. When you upload with multipart/form-data, send privacy and the other text fields before the file parts. If the server sets an uploader password, send it in X-Uploader-Password.

Build from source

git clone https://github.com/overcuriousity/bitvault && cd bitvault
SQLX_OFFLINE=true cargo build --release
./target/release/bitvault --config config.example.toml

Licence

GPL-3.0-only. The original Microbin project was published by Dániel Szabó under the BSD-3-Clause licence (ORIGINALLICENSE.txt). Third-party licences are in THIRD-PARTY-LICENSES.