Using only 6 characters as a 'private' URL is too small. How long does it take to have a bot that can make 1000 requests per second to download every single URL in your URL space?
((alphabet_size^number_url_characters)/(request_speed))/secs/mins/hrs = time_in_days
((26^6)/(1000))/60/60/24 = 3.6 days
Reading every single paste in 3.6 days is not private.
You want to reduce the probability of a single URL guess colliding with an existing 'private' URL so that it would take years for a bot to have a decent chance of finding a URL that is already in use.
Read up on the probability of hashing collisions and how fast bots can make requests. Make sure it takes a long time to make enough guesses to have a chance at collision.
If you don't want to do math, just use as many characters as an established company that already has 'private URL sharing'. ex Dropbox, I think they use ~40 case-sensitive-alphanumeric-characters or something.