Yopass Open Source vs. Business License: What's the Difference?

The core difference is scope, not security model. Yopass Open Source is free to self-host forever and includes end-to-end encryption, one-time secret links, file uploads, and configurable expiration (1h / 1d / 1w). The Business License costs €149 per year, still runs on your own infrastructure, and adds custom branding, a higher upload size limit, and governance features: secret requests, read receipts, webhooks, OpenID Connect sign-in, and audit logs. Choose Open Source if you need private secret sharing for individuals or a small team; choose the Business License if you need to prove who accessed what, accept secrets from outside parties, or put secret creation behind single sign-on.

Side-by-Side Comparison

What Both Versions Share

Both editions run the same three-step workflow, and the security properties do not change between them:

1. Encrypt — the secret is encrypted in the browser before anything leaves the machine.
2. Share — you get a unique one-time link; the decryption key never touches the server.
3. Expire — the secret self-destructs after being viewed or when the timer runs out.

Both are open source at the core and deployable via Docker and Kubernetes with a Redis or Memcached backend. If your only goal is to stop passwords and API keys from living in Slack, email, and ticket systems, the free edition already solves that problem.

When the Business License Is Worth It

The paid tier is about governance, not encryption. Consider it if any of these apply:

• You receive secrets from people outside your organization. Secret Requests let you send a link; the vendor or client uploads the secret, and you receive it encrypted — no Yopass account needed on their side.
• You need to know when a link was opened. Read Receipts notify you by email or webhook the moment a one-time link is decrypted.
• You need an audit trail. Audit Logs record security-relevant events such as secret creation, access, and deletion without exposing secret contents — for example, an entry like secret.created with outcome, user email, client IP, secret ID, and whether it was one-time.
• You want automated reactions. Webhooks push security events into your SOC or dev workflows when secrets are created, requested, or accessed.
• You want to control who can create secrets. OpenID Connect sign-in requires users to authenticate through your identity provider before sharing.
• You need branding or larger files. Custom branding and theming, plus a higher upload size limit.

How to Decide

Ask two questions:

1. Does anyone outside my team need to send me secrets, or do I need evidence of access? If yes, the Business License is the relevant option.
2. Is my need simply "share a password without leaving it in chat"? If yes, self-host the Open Source edition and stop there.

A practical middle path: start with the free self-hosted edition, confirm the workflow fits your team, and upgrade only when a governance requirement (audit, SSO, receipts, external requests) actually appears. Because both editions run on your own infrastructure, the upgrade does not change where your data lives.

One caveat to verify before committing: the page lists the Business License at €149/year but does not detail per-seat limits, exact upload size ceilings, or how licensing is enforced on a self-hosted instance. Confirm those terms directly with Yopass if your decision depends on team size or file sizes.