Design Pastebin — System Design Interview Practice

Interview prompt

Design text snippets with generated URLs, expiration, and sharing so users can create and retrieve a paste reliably at scale.

• Define the source of truth for paste content and ownership and make retries idempotent.
• Use bounded, partitioned state to meet 10M pastes per day and 100K reads per second and p95 <=100ms reads.
• Separate the critical request path from expiration cleanup, abuse scanning, and analytics.
• Explain consistency, failure recovery, authorization, observability, and a degraded mode.

Requirements and scale assumptions

• Support the core workflow to create and retrieve a paste.
• Expose status, results, and freshness appropriate to text snippets with generated URLs, expiration, and sharing.
• Support authorization, validation, updates, deletion, and recovery semantics.
• Meet p95 <=100ms reads under normal load.
• Scale to 10M pastes per day and 100K reads per second without a single hot key or unbounded synchronous work.
• Do not lose committed state; make retries and duplicate events safe.
• Degrade safely when downstream workers, caches, or external dependencies fail.
• 10M pastes per day and 100K reads per second
• Partition by the primary tenant, user, item, or geographic key and isolate hot partitions.
• Keep serving state bounded; retain raw events or durable records for replay and auditing.

• Peak scale: 10M pastes per day — Capacity assumption that drives partitioning and backpressure.
• Latency target: p95 <=100ms reads — User-facing budget for the primary request or read path.
• Durable boundary: Committed before async — The source of truth is paste content and ownership.
• Async boundary: At-least-once workers — Keep expiration cleanup, abuse scanning, and analytics off the synchronous path.

Key entities

• PastepasteId, ownerId, contentHash, visibility, expiresAt, createdAt, status

  Immutable or versioned text content with ownership and expiry.

• ShortAliasalias, pasteId, createdAt, status

  Unique lookup key mapped to a paste without exposing database identifiers.

• AccessPolicypasteId, visibility, passwordHash, allowedUsers, expiresAt, version

  Versioned access and retention policy.

• AbuseScanscanId, pasteId, scannerVersion, findings, status, completedAt

  Asynchronous moderation and malware/secret scan result.

Data flow

1. 1. Create and validate a pasteThe API checks size, expiry, visibility, abuse policy, and idempotency, then stores content and alias metadata durably.
2. 2. Resolve a short aliasEdge and cache look up the alias; cache misses read metadata and content, recheck expiry and access policy, and return a bounded response.
3. 3. Scan and moderate asynchronouslyA queue sends content to secret, malware, and abuse scanners; a policy result can hide a paste without deleting audit evidence.
4. 4. Expire and delete safelyExpiry workers write tombstones, evict aliases, and delete content by lifecycle policy while preserving ownership and deletion audit.
5. 5. Measure reads without hurting redirectsClick/read events leave the serving path and are aggregated asynchronously with privacy and retention controls.

Deep dives and trade-offs

• Alias resolution and cache safetyFor the Pastebin-like paste service, an alias must never resolve to expired, deleted, or unauthorized content. Design for the failure case where a hot alias, abuse burst, or cleanup lag must not expose content or take down reads; keep retries, versions, and repair state explicit. Expose freshness, version, lineage, or audit metadata so operators and clients can distinguish current, pending, and degraded state.
• Expiry, deletion, and lifecycleFor the Pastebin-like paste service, an alias must never resolve to expired, deleted, or unauthorized content. Keep this concern off unrelated request paths and partition it by the Pastebin-like paste service access key. Expose freshness, version, lineage, or audit metadata so operators and clients can distinguish current, pending, and degraded state.
• Abuse scanning without blocking readsFor the Pastebin-like paste service, an alias must never resolve to expired, deleted, or unauthorized content. Keep this concern off unrelated request paths and partition it by the Pastebin-like paste service access key. Expose freshness, version, lineage, or audit metadata so operators and clients can distinguish current, pending, and degraded state.
• Mutable paste versus immutable versionsPrefer immutable content versions and an explicit latest pointer when editing is required. In-place edits complicate cache invalidation, audit, and link consistency.
• Synchronous scan versus fast creationAccept within size/policy limits and quarantine or label content while deep scanning asynchronously. Blocking every create on scanners raises tail latency and couples availability to third parties.
• Long cache TTL versus revocationUse short policy-aware TTLs and targeted invalidation for password, delete, and abuse changes. A long TTL improves hot reads but can serve revoked or expired content.