Pastebin

Store text/code blobs with TTL and access control.

SavedSaved on this device

The problem

Store text/code blobs with TTL and access control.

Build a Pastebin-class service: users submit a text / code blob (a "paste"), receive a short URL, share it. Anyone with the URL can read the blob until it expires or is taken down. Visibility ranges from public (search-engine-indexable, edge-cacheable) through unlisted (URL is the secret) to private (owner-only, JWT-authed) and password-protected (server-side check). The system spans an edge CDN, a metadata DB, an object store for bytes, an async abuse pipeline, and a TTL sweeper.

The interview-tier 6-node sketch is wrong here in three load-bearing ways: (1) it under-models the cache-key story for private content; (2) it treats S3 lifecycle as the source of truth for TTL; (3) it puts blob storage on the same Postgres as metadata. We unwind all three.

Reading: Cloudflare KV outage (2025-06-12) · Discord — How Discord Stores Trillions of Messages · GitHub — sharded replicated rate limiter in Redis · AWS S3 — performance design patterns + lifecycle · Cloudflare — Tiered Cache & Argo · PrivateBin / 0bin — zero-knowledge paste

object store + metadata DB split
edge cache key design (Vary, Cache-Control: private)
TTL: lazy on-read + active sweeper + S3 lifecycle
viral hot key (single-flight, tiered cache)
outbox txn for async fan-out
abuse / DMCA control plane
S3 hot-prefix throttling (3,500 PUT/sec)

01Clarifications

What would you ask before drawing a single box?

Ambiguity you would resolve with the interviewer: scope, scale, who uses it, what counts as done.

About Pastebin

Store text/code blobs with TTL and access control.

Difficulty: beginner
Time: about 50 minutes
Stages: 10
Topic: System Design Fundamentals

How this problem is worked

Ten stages, from the questions you would ask an interviewer to the trade-offs you would defend. Each asks one question, and the simulator runs the architecture you draw against the requirements you wrote.

01ClarificationsWhat would you ask before drawing a single box?
02Functional reqsWhat must this system actually do?
03Non-functionalWhat must it promise about speed, uptime and correctness?
04Capacity estimationHow much load and data does this have to hold?
05API designWhat does the outside world call, and what comes back?
06Data modelWhat gets stored, and what is it looked up by?
07Use-case breakdownHow does each requirement actually get served?
08High-level designWhich components handle a request, and in what order?
09Deep divesWhich part breaks first, and what do you do about it?
10Trade-offsWhat did this design cost, and what breaks at 10×?

Primary sources for this problem

Cloudflare KV outage (2025-06-12)
Discord — How Discord Stores Trillions of Messages
GitHub — sharded replicated rate limiter in Redis
AWS S3 — performance design patterns + lifecycle
Cloudflare — Tiered Cache & Argo
PrivateBin / 0bin — zero-knowledge paste

More in System Design Fundamentals

The four primitives every later problem assumes — unique IDs, rate limits, caching a read-heavy endpoint, and making a retry safe.

Browse the full problem catalog, or see what the simulator does and does not model.