What Is Yopass and What Does It Do?

Yopass is an open-source secret-sharing tool that encrypts passwords, API keys, and files in your browser, then gives you a one-time link that expires after the secret is viewed or when a timer runs out. It fits teams and individuals who currently pass credentials through Slack, email, or ticket systems and want to stop leaving them in plaintext. It is free to self-host, with an optional business license (€149/year) that adds branding and higher limits.

How Yopass Works

Yopass follows a three-step flow, and the important detail is where encryption happens.

1. Encrypt — You type or paste the secret. Encryption happens in your browser before anything leaves your machine.
2. Share — You get a unique one-time link. You can send it through any channel, because the decryption key never touches the server.
3. Expire — The secret self-destructs after it is viewed, or when the timer runs out. Nothing persists.

The practical consequence: the server stores ciphertext, not your secret. Even someone with access to the server cannot read the content without the key, which is why the link itself is the sensitive part — treat it like the secret.

What You Can Share

• Passwords
• API keys
• Files (file upload is supported)

Expiration Options

Configurable expiration is available at 1 hour, 1 day, or 1 week. One-time links are the default behavior described on the site: the secret is gone after the first view.

Who It Is For

Yopass targets the everyday habit of pasting credentials into chat and tickets. As the site puts it, secrets shared over Slack, email, and tickets "sit in plaintext — searchable forever, readable by anyone with access." Yopass replaces that with an encrypted link that disappears.

A concrete case: a developer needs to hand a staging database password to a contractor. Instead of a Slack DM that lives in history, they paste it into Yopass, set a 1-hour expiry, and send the one-time link. Once the contractor opens it, the secret is gone from the server.

Open Source vs. Business License

Both editions run on your own infrastructure. The difference is governance features and limits.

What the Business Features Do

• Secret Requests — Send a request link to a vendor or client who does not use Yopass; they upload the secret and you receive it encrypted.
• Read Receipts — Get notified by email or webhook the moment a one-time link is decrypted.
• Webhooks — Push security events (secret created, requested, or accessed) into your SOC or dev workflows.
• OpenID Connect Sign-In — Require users to authenticate through your OIDC provider before creating a secret.
• Audit Logs — Record events such as secret creation, access, and deletion without exposing secret contents.

Deployment Requirements

Yopass is designed for self-hosting. The site lists:

• Backend storage: Redis or Memcached
• Deployment: Docker and Kubernetes
• Source: available on GitHub, with community support through GitHub

If you already run Redis or Memcached and a container platform, the infrastructure fit is straightforward. If you do not, plan for that dependency before deploying.

How to Decide

Choose Yopass if:

• You want to self-host and keep control of the infrastructure.
• You need browser-side encryption with one-time, expiring links.
• You want an open-source tool with no vendor lock-in.

Choose the business license if:

• You need audit logs, read receipts, or webhooks for compliance or incident response.
• You want to collect secrets from external parties via request links.
• You need SSO enforcement through OpenID Connect.

Look elsewhere if:

• You want a fully managed service with no infrastructure to run — Yopass is built around self-hosting.
• You need features beyond the listed set; check the GitHub project for current capabilities before committing.

Getting Started

The site offers a demo and a "Get Started" path, plus the GitHub repository for self-hosting. The free tier is open source and free to self-host permanently; the business license is €149/year and still runs on your own infrastructure.