They're primarily for content ownership management.

I'd prefer not to have accounts, and Ghostbin tries to avoid keeping identifiable information around, but they do come in fairly handy for maintaining control of the things you've pasted and the right to revoke them.

Session cookies aren't quite up to the task, since they can't stick around forever and are difficult to bring with you between workspaces.

(edit to elaborate on "avoid keeping identifiable information": account names are hashed, the account never stores user identification, and a paste doesn't track which account created it. For most intents and many purposes, the creator of a paste is anonymous. We could get into drawing correlations between all the pastes owned by an account, but I'm not particularly interested in sitting around and doing that.)

Deletion. Modification of pastes and maintaining the same id (URL).

Though, these can be solved with tokens per post, it's tough to remember/maintain multiple tokens, doesn't work out in practice.

Preventing inundation with pastes. This is less of a problem for a small project like this compared to one of the major sites, whose server architecture is probably more robust.