Show HN: I made a pastebin that stores its contents in the URL

So I've been having a fever for this week, which turned out to be COVID. Due to that I've had a lot of time to sit around and watch TV, but also type out some silly code. In a Discord server I frequent a person wondered if it would be possible to create an anonymous pastebin that stored the contents in the URL and not on the server. I got excited to test it out and Tahnaroskakori (Finnish for the very literal translation of "pastebin") was born.

Naturally it's open source[0], and it has followed the typical trajectory of a quick hack project: it started as a clean, tiny implementation, and then adding line numbers and syntax highlighting ballooned it into a more messy state. The most challenging part was dynamically loading Prism.js highlighting when the library itself doesn't have ES module support, and I didn't want to set up a bundler tool or NPM.

Technically speaking, the pastebin contents are converted into UTF-8 bytes, then compressed using brotli, and finally encoded to the hash of the URL using a base-something alphabet. I removed some technically hash safe characters because linkifiers tend to cut off links when they encounter some of them, like ")". There is a small extensible header tacked to the front before compression, it contains the selected language for now but could contain more in the future. Though the only feature I've thought of is setting the starting line number.

URLs have a generally accepted character limit of 2048 characters (to my knowledge), so that's what is the limit for the paste. You can't really say what amount of input that corresponds to due to the brotli compression, but there are some numbers on the bottom of the page that try to help you estimate. I find it interesting to just type things and see how it affects the output length. Sometimes _adding_ a word or even a comma can cut several characters off the URL length! At very small inputs, the compressed size is bigger than the original size, making it just put the content in the URL uncompressed would be an improvement there.

If you can break or XSS it, I would be glad to know. :) I think I'll use this for my own pastebin purposes simply because it's fun and fast (and I don't need an account to use it). I don't expect it to become widely used, but I'll keep it on the GitLab page and promise not to break the hash format anymore (which is now possible to avoid thanks to the extensible header part).

I've tested it on Vivaldi, Safari, and Firefox on macOS, and quickly on Vivaldi in Android. If you have problems with it on some browser/OS, please file an issue or even better a PR. A very recent browser version is required due to usage of TransformStream[1].

[0] https://gitlab.com/Nicd/t [1] https://caniuse.com/mdn-api_transformstream