How Yopass Keeps Shared Secrets Secure

Updated

Yopass protects a shared secret by encrypting it in your browser before it is uploaded, storing only the ciphertext on the server, and giving you a one-time link whose decryption key stays in the link fragment rather than reaching the server. The secret is destroyed after it is viewed once or when its timer expires. This applies to passwords, API keys, and files shared through the hosted service or a self-hosted instance.

The three-step flow

The site describes the process in three stages:

  1. Encrypt — You type or paste the secret. Encryption happens in your browser before anything leaves your machine.
  2. Share — You receive a unique one-time link. You can send it through any channel, because the decryption key never touches the server.
  3. Expire — The secret self-destructs after being viewed, or when the timer runs out. Nothing persists.

The key design point is the split between what the server holds and what the link holds. The server stores ciphertext; the part of the link that can decrypt it stays with the recipient. Anyone who intercepts the link can open the secret once, so the link itself is the sensitive artifact — treat it like the secret.

Why this beats chat and email

Passwords and API keys pasted into Slack, email, or tickets sit in plaintext: searchable indefinitely and readable by anyone with access to that history. Yopass replaces that permanent record with a single view and an expiry. The protection is bounded by the link's lifetime and one-time use, not by trusting everyone with access to the channel.

What the server actually keeps

Element Where it lives Consequence
Secret contents Encrypted in browser, stored as ciphertext Server operator cannot read it
Decryption key In the one-time link Never sent to the server
Link validity One view or a timer (1h / 1d / 1w) Expires automatically
Residual data Removed after view or expiry Nothing persists

Expiration is configurable at 1 hour, 1 day, or 1 week. File upload is supported, so the same model covers documents as well as text.

Self-hosting and the business tier

Yopass is open source and free to self-host, described as free "forever," with Docker and Kubernetes deployment and a Redis or Memcached backend. The business license is €149 per year, self-hosted, and adds custom branding, higher upload size, and governance features:

  • Secret Requests — send a link so a vendor or client can upload a secret to you encrypted.
  • Read Receipts — email or webhook notification when a one-time link is decrypted.
  • Webhooks — push creation, request, and access events into your SOC or dev workflows.
  • OpenID Connect sign-in — require SSO before a user can create a secret.
  • Audit Logs — record creation, access, and deletion events without exposing secret contents.

The audit log example on the site shows fields such as outcome, user email, client IP, secret ID, and a one-time flag — metadata about the event, not the secret itself.

Limits worth knowing before you rely on it

  • The link is the credential. One-time use limits exposure, but a recipient who forwards the link before opening it hands over access.
  • One view means one view. If the recipient loses the decrypted content, it cannot be recovered from the server.
  • Governance is a paid feature. Audit logs, read receipts, SSO gating, and secret requests require the business license; the open-source edition covers encryption, one-time links, files, and configurable expiry.
  • Self-hosting shifts trust. Running your own instance keeps ciphertext on your infrastructure, but you are then responsible for its operation and backend.

For a quick one-off password handoff, the free flow is sufficient. For an organization that needs proof of when a credential was opened or wants secret creation behind SSO, the business license is the relevant tier.