How to Share a Secret with Yopass Step by Step

To share a secret with Yopass, you paste it into the browser tool, get a one-time link, and send that link to the recipient through any channel. The secret is encrypted in your browser before it leaves your machine, the decryption key never reaches the server, and the secret self-destructs after it is viewed or when the expiration timer runs out. This works for passwords, API keys, and files, and you can use the hosted service or self-host the open-source version.

Before You Start

• A secret to share — a password, API key, or file.
• A channel to send the link — email, chat, or a ticket system all work, because the link alone is useless without the decryption key that stays in the link fragment.
• An expiration choice — Yopass offers configurable expiration of 1 hour, 1 day, or 1 week.
• A recipient — anyone who can open a browser link.

You do not need an account to share a single secret on the standard flow. Team features such as read receipts, webhooks, and OpenID Connect sign-in are part of the business license.

Step 1: Encrypt the Secret in Your Browser

Open Yopass and type or paste your secret into the input. The encryption happens locally in your browser before anything is transmitted, so the plaintext never leaves your machine.

What happens under the hood: Yopass encrypts the secret with OpenPGP in the browser and produces ciphertext. Only the ciphertext is sent to the server. The decryption key is kept in the link itself — specifically in the part of the URL that browsers do not send to servers.

Expected result: you see a generated one-time link, and the server holds only encrypted data.

Step 2: Send the One-Time Link

Copy the unique link and send it through whatever channel you already use. The site's own framing is that secrets don't belong in your chat history — the point is that the link can travel through Slack, email, or a ticket, while the secret itself does not sit there in plaintext.

Practical notes:

• Send the link the same way you would send any URL. There is no separate key to transmit.
• The link is one-time: once opened and decrypted, it cannot be used again.
• If the timer runs out before the recipient opens it, the secret is gone and you must create a new one.

Expected result: the recipient has a link that will work exactly once, until it expires.

Step 3: Recipient Opens the Link Once

The recipient opens the link in a browser. Decryption happens on their side, using the key embedded in the link. After the secret is viewed, it self-destructs — nothing persists on the server.

Expected result: the recipient sees the secret once; a second visit to the same link returns nothing.

Step 4: Confirm Expiration Behavior

Two independent limits end a secret's life:

If delivery is uncertain, choose a longer window but confirm the recipient is ready to open it. If the secret is highly sensitive, choose 1 hour and coordinate the handoff in real time.

Common Snags

• Recipient says the link is empty. Most likely it was already opened once, or the timer expired. Generate a new secret.
• You pasted the secret into chat by mistake. Delete the message where you can; a one-time link does not protect a secret you already sent in plaintext.
• You need proof of receipt. Standard one-time links do not notify you. Read receipts (email or webhook notification when a link is decrypted) are a business-license feature.
• You want to receive a secret rather than send one. Secret Requests let you send a request link so a vendor or client uploads the secret to you encrypted — also a business-license feature.
• You need SSO or an audit trail. OpenID Connect sign-in and audit logs of creation, access, and deletion (without exposing contents) are part of the business license.

Self-Hosting and Licensing at a Glance

Yopass is open source and free to self-host, always. The open-source edition includes end-to-end encryption, one-time links, file upload, configurable expiration, localization, Redis or Memcached backend, and Docker plus Kubernetes deployment. The recommended Business License is €149 per year, self-hosted, and adds custom branding and theming, higher upload size, secret requests, read receipts, webhooks, OpenID Connect sign-in, and audit logs.

Choose the open-source edition if you want a free, self-run tool for individual or small-team sharing. Choose the business license if you need governance features — receipts, SSO, audit logs, or inbound secret requests — while still running on your own infrastructure.