yopass.se

An open-source UI element library is a collection of individual, ready-made interface pieces—buttons, cards, inputs, toggles, loaders—that you copy into your own project and adapt. A UI framework, by contrast, is a structured system of components, conventions, and often a theming layer that governs how your whole interface is built. The practical difference: an element library gives you a snippet; a framework gives you a way of working. If you need a polished button in ten minutes, reach for the element library. If you're building a 40-screen product with a team, you probably want the framework.

What "open-source UI element library" actually means

The term gets used loosely, so it helps to separate the parts:

• Open-source: the code is publicly available, and the license tells you what you may do with it—copy, modify, redistribute, or use commercially.
• UI element: a single, self-contained piece of interface, usually small enough to read in one sitting. A button with hover states, a pricing card, a search field.
• Library: a browsable, searchable collection of those elements, typically contributed by many different people.

On a site like Uiverse, elements are shared by a community and written in plain CSS or Tailwind. You find one you like, copy the markup and styles, paste them into your project, and adjust colors, spacing, and text to fit. There's no package to install and no build step required—which is exactly the appeal, and also the source of most of the confusion.

Element library vs. UI framework: the core differences

The table isn't a verdict. It's a map of trade-offs. Element libraries win on speed and freedom; frameworks win on consistency and maintenance.

Licensing and attribution: what to check before you paste

This is where people get into trouble, and it's worth slowing down for.

1. Find the license. Every element or collection should state one. Common open-source licenses include MIT, Apache-2.0, and BSD. Some projects use copyleft licenses like GPL, which can impose obligations if you redistribute your code.
2. Understand what the license permits. MIT and Apache-2.0 are permissive: you can typically use the code in commercial and closed-source projects. Copyleft licenses may require you to release derivative source under the same terms.
3. Check attribution requirements. Permissive licenses usually require you to keep the copyright notice and license text somewhere in your project. That's a real obligation, not a formality.
4. Look for per-element terms. On community sites, the site's overall terms and the individual contributor's stated wishes may differ. If a contributor asks for credit, honor it.
5. When in doubt, ask or avoid. If a snippet has no license at all, you don't have clear permission to reuse it. Treat "no license" as "not open source," even if the code is publicly visible.

This article is general information, not legal advice. For commercial products with real exposure, have someone qualified review the licenses you're relying on.

How to use a community element in your project: a practical workflow

Here's a repeatable process that avoids most of the usual mess.

1. Start from a real need, not a browsing session

Decide what you need first—"a compact primary button with a loading state"—then search. Browsing aimlessly produces a pile of pretty snippets that don't fit together.

2. Copy the smallest version that works

Take the markup and the styles. Strip anything you don't need: demo wrappers, extra animations, decorative layers. Less code means fewer surprises.

3. Convert it to your conventions

If your project uses design tokens or CSS variables, replace hard-coded values:

/* Before: hard-coded */
.button { background: #4f46e5; border-radius: 8px; }

/* After: token-based */
.button { background: var(--color-primary); border-radius: var(--radius-md); }

This one step is what keeps a copied element from looking like a foreign object in your UI.

4. Check accessibility before you ship

Community elements vary widely here. Verify at minimum:

• Keyboard focus is visible and the element is reachable by Tab.
• Color contrast meets WCAG AA (4.5:1 for normal text).
• Interactive elements use semantic HTML (<button>, not a clickable <div>).
• Form inputs have associated labels.
• Motion respects prefers-reduced-motion.

5. Test in context

Paste it into a real page with real content. Long labels, small screens, and dark mode break more copied elements than anything else.

6. Note where it came from

Keep a short comment or an internal credits file: source, license, date. Future you—and your legal reviewer—will be grateful.

Where element libraries genuinely shine

• Prototypes and demos: you need something clickable today, not a design system.
• Landing pages and marketing sites: a handful of distinctive elements, each custom.
• Filling gaps: your framework lacks one specific component, and you don't want to build it from scratch.
• Learning: reading well-made CSS is one of the fastest ways to improve.
• Small projects: a personal site doesn't need a theming architecture.

Where they fall short

• Consistency at scale: ten elements from ten contributors rarely look like one product.
• Maintenance: you own every copy. When your design changes, you edit each one.
• Accessibility debt: you inherit whatever the contributor did or didn't do.
• No upstream fixes: a bug fixed in the original won't reach your copy.
• Integration friction: different naming conventions, different units, different assumptions about resets.

When to choose which

Choose an element library when the scope is small, the timeline is short, or you need a few distinctive pieces rather than a whole system.

Choose a framework or design system when multiple people build multiple screens over months, when consistency is a product requirement, or when accessibility and theming need to be guaranteed rather than checked.

A hybrid works well for many teams: adopt a framework for the structural components—forms, navigation, layout—and borrow individual elements for the places where you want personality. Just route every borrowed element through the same token and accessibility checks, so it lands as part of your system rather than beside it.

The short version: open-source UI element libraries are a fast, flexible way to get good-looking interface pieces into a project. They are not a substitute for a design system, and the license and accessibility details are the part worth reading carefully.

Yopass protects a shared secret by encrypting it in your browser before it is uploaded, storing only the ciphertext on the server, and giving you a one-time link whose decryption key stays in the link fragment rather than reaching the server. The secret is destroyed after it is viewed once or when its timer expires. This applies to passwords, API keys, and files shared through the hosted service or a self-hosted instance.

The three-step flow

The site describes the process in three stages:

1. Encrypt — You type or paste the secret. Encryption happens in your browser before anything leaves your machine.
2. Share — You receive a unique one-time link. You can send it through any channel, because the decryption key never touches the server.
3. Expire — The secret self-destructs after being viewed, or when the timer runs out. Nothing persists.

The key design point is the split between what the server holds and what the link holds. The server stores ciphertext; the part of the link that can decrypt it stays with the recipient. Anyone who intercepts the link can open the secret once, so the link itself is the sensitive artifact — treat it like the secret.

Why this beats chat and email

Passwords and API keys pasted into Slack, email, or tickets sit in plaintext: searchable indefinitely and readable by anyone with access to that history. Yopass replaces that permanent record with a single view and an expiry. The protection is bounded by the link's lifetime and one-time use, not by trusting everyone with access to the channel.

What the server actually keeps

Expiration is configurable at 1 hour, 1 day, or 1 week. File upload is supported, so the same model covers documents as well as text.

Self-hosting and the business tier

Yopass is open source and free to self-host, described as free "forever," with Docker and Kubernetes deployment and a Redis or Memcached backend. The business license is €149 per year, self-hosted, and adds custom branding, higher upload size, and governance features:

• Secret Requests — send a link so a vendor or client can upload a secret to you encrypted.
• Read Receipts — email or webhook notification when a one-time link is decrypted.
• Webhooks — push creation, request, and access events into your SOC or dev workflows.
• OpenID Connect sign-in — require SSO before a user can create a secret.
• Audit Logs — record creation, access, and deletion events without exposing secret contents.

The audit log example on the site shows fields such as outcome, user email, client IP, secret ID, and a one-time flag — metadata about the event, not the secret itself.

Limits worth knowing before you rely on it

• The link is the credential. One-time use limits exposure, but a recipient who forwards the link before opening it hands over access.
• One view means one view. If the recipient loses the decrypted content, it cannot be recovered from the server.
• Governance is a paid feature. Audit logs, read receipts, SSO gating, and secret requests require the business license; the open-source edition covers encryption, one-time links, files, and configurable expiry.
• Self-hosting shifts trust. Running your own instance keeps ciphertext on your infrastructure, but you are then responsible for its operation and backend.

For a quick one-off password handoff, the free flow is sufficient. For an organization that needs proof of when a credential was opened or wants secret creation behind SSO, the business license is the relevant tier.

OpenAPI-generated API documentation is reference documentation that is produced automatically from an OpenAPI description file rather than written by hand. You write (or generate) a machine-readable specification of your API — endpoints, parameters, request bodies, responses, schemas, and auth — and a documentation tool reads that file and renders a browsable, often interactive reference site. The spec becomes the single source of truth; the docs become a build artifact.

This differs from manually written docs in one fundamental way: with hand-written docs, the prose is the source of truth and the API is described separately. With spec-driven docs, the API description is the source, and every page, table, and code sample is derived from it.

How the workflow actually runs

A typical spec-driven documentation pipeline has five stages:

1. Author or generate the spec. You either write an OpenAPI document by hand (YAML or JSON), or generate it from code annotations, framework metadata, or a design-first editor. Design-first means the spec is written before implementation; code-first means it is extracted from existing code.
2. Validate and lint. The spec is checked against the OpenAPI schema and against style rules — consistent naming, required descriptions, no undocumented 4xx responses, no orphaned schemas.
3. Bundle and transform. Multi-file specs are combined, $ref pointers are resolved, and the document is optionally split into per-tag or per-version outputs.
4. Render. A documentation tool converts the spec into HTML: an endpoint list, a sidebar of operations, parameter tables, response schemas, and a "try it" console.
5. Publish and version. The rendered site is deployed, and each API version gets its own snapshot so consumers can read docs matching the version they call.

Steps 2 through 5 are usually automated in CI. If the spec fails validation, the docs build fails — which is the point.

Spec-driven vs. hand-written documentation

The practical conclusion most teams reach: generate the reference, write the guides. Reference material is repetitive and mechanical, which is exactly what generation is good at. Conceptual explanations, migration notes, and tutorials carry judgment that a spec cannot express.

What you get out of the box

Generated reference pages commonly include:

• An operation list grouped by tag or path, with HTTP method and path.
• Parameter tables showing name, location (path, query, header, cookie), type, required flag, and description.
• Request and response schemas rendered as expandable trees, including nested objects and arrays.
• Authentication details pulled from the securitySchemes section.
• Interactive request consoles that let a reader send a real call from the browser.
• Generated code samples in several languages, derived from the same schemas.
• Multiple output formats, such as a static site, a single HTML file, or a mock server.

Because all of these come from one document, changing a field name in the spec updates the parameter table, the schema tree, and every code sample at once.

Where spec-driven documentation breaks down

Generation is not free. The trade-offs are real:

Spec quality becomes documentation quality. A field with no description produces a table row with an empty cell. A vague summary produces a vague heading. Tools can enforce presence of descriptions via linting, but they cannot enforce that the description is useful.

Customization has limits. If you need a page that does not map to an OpenAPI concept — a conceptual overview, a pricing explanation, a comparison of two endpoints — you write it outside the generator and link to it.

Not everything is expressible. Webhooks, streaming responses, long-polling behavior, and complex multi-step flows are awkward or impossible to describe fully in OpenAPI. Those need prose.

The spec can go stale. If the spec is maintained separately from the implementation, it drifts just like hand-written docs. The mitigation is to generate the spec from code, or to test the implementation against the spec in CI.

Interactive consoles need care. A "try it" button that hits a production API with real credentials is a security and rate-limit problem. Point it at a sandbox, or disable it.

Deciding whether to adopt it

Adopt spec-driven reference documentation if most of these are true:

• Your API has more than a handful of endpoints, or changes frequently.
• You ship client SDKs or code samples in more than one language.
• Multiple teams consume the API and need a consistent, always-current reference.
• You already have, or are willing to maintain, an OpenAPI description.

Stay with hand-written docs, or a hybrid, if:

• Your API is small and stable, and the reference fits on one page.
• Your documentation is mostly conceptual and contains little endpoint-level detail.
• You cannot commit to keeping the spec in sync with the implementation.

A reasonable middle path: generate the reference from the spec, and hand-write the getting-started guide, authentication walkthrough, and error-handling page. Link the two directions so readers can move from concept to endpoint and back.

A minimal starting checklist

1. Produce one valid OpenAPI document for a single API version.
2. Add a linter with rules for descriptions, operation IDs, and error responses.
3. Wire the docs build into CI so a failing spec fails the build.
4. Render the reference and review it as a reader, not as the author.
5. Write the two or three conceptual pages the generator cannot produce.
6. Version the published docs alongside the API version.

The core idea is simple: describe the API once, in a format both machines and humans can read, and let the reference documentation fall out of that description. Everything else — tooling, hosting, interactivity — is a detail on top of that decision.

Yopass's team and business features are bundled in a paid Business License (€149/year, self-hosted) and cover four areas: Secret Requests to collect credentials from outside parties, Read Receipts and Webhooks to know when a secret is opened, OpenID Connect sign-in to put secret creation behind single sign-on, and Audit Logs that record security events without exposing secret contents. These features are for organizations that already use Yopass or plan to self-host it and need governance over how credentials move in and out of the team. The open-source edition remains free to self-host but does not include them.

Secret Requests: Collecting Credentials From People Outside Yopass

Secret Requests reverse the usual flow. Instead of you creating a secret and sending a link, you send a request link to a vendor or client who doesn't use Yopass. They upload the secret through that link, and you receive it encrypted.

This matters when the other party has no account, no self-hosted instance, and no reason to learn a new tool. The request link is the only thing they interact with, and the secret still arrives encrypted rather than sitting in an email thread or a shared document.

Use it when:

• Onboarding a vendor who needs to hand over API credentials
• Receiving account details from a client during a project handoff
• Collecting any credential from someone outside your organization's identity system

Read Receipts and Webhooks: Knowing When a Secret Is Opened

A one-time link is only useful if you know whether it was actually used. Yopass's business tier adds:

• Read Receipts — notification by email or webhook the moment a one-time link is decrypted, so you know exactly when a secret is opened.
• Webhooks — push security events into your SOC or dev workflows, triggering automated actions when secrets are created, requested, or accessed.

The practical difference: with read receipts, "I sent it" becomes "they opened it at 14:32." With webhooks, that event can flow into an existing alerting or ticketing pipeline instead of requiring someone to check a dashboard.

OpenID Connect Sign-In: Putting Secret Creation Behind SSO

OpenID Connect sign-in requires users to authenticate through your OIDC provider before they can create a secret. This turns secret sharing from an open capability into an action tied to a known identity.

It fits organizations that already run an identity provider and want secret creation to follow the same access rules as other internal tools — no separate credentials, no anonymous creation. Note that this governs creation; the page describes it as putting secret creation behind single sign-on, so plan your rollout around who needs to create versus who only receives links.

Audit Logs: A Record Without the Secret

Audit logs record security-relevant events — secret creation, access, and deletion — without exposing the secret contents. The page shows the shape of an event:

2026-06-17T14:32:01Z secret.created
{"outcome":"success","user_email":"[email protected]","client_ip":"203.0.113.42","secret_id":"e065107b78ac","one_time":true}

You get who created it, from which IP, which secret ID, and whether it was one-time — but not the password or key itself. That is the point: the log is safe to retain and review, and it gives you a clear audit trail across the organization.

What the Business License Adds Beyond Governance

The Business License is €149/year, self-hosted, and includes everything in the open-source edition plus:

Both editions run on your own infrastructure — the page frames self-hosting as what makes the setup "truly secure," and the business tier does not move you to a hosted service.

How to Decide

• Choose open source if you need encrypted one-time links and file sharing for a small team and handle governance informally.
• Choose the Business License if you must collect credentials from outside parties (Secret Requests), prove when a secret was opened (read receipts/webhooks), tie creation to SSO (OIDC), or keep an audit trail for compliance — and you are willing to run it on your own infrastructure.
• Check before committing: the page lists "higher upload size" for the business tier but does not state the exact limit, and it does not detail per-seat pricing or user-count limits. Confirm those with the vendor if upload size or team size is a deciding factor.

A reasonable rollout: start with the free self-hosted edition to validate your deployment (Docker/Kubernetes plus Redis or Memcached), then add the Business License when you need to bring vendors or clients into the workflow or require SSO and audit records.

Yopass is an open-source secret-sharing tool that encrypts passwords, API keys, and files in your browser, then gives you a one-time link that expires after the secret is viewed or when a timer runs out. It fits teams and individuals who currently pass credentials through Slack, email, or ticket systems and want to stop leaving them in plaintext. It is free to self-host, with an optional business license (€149/year) that adds branding and higher limits.

How Yopass Works

Yopass follows a three-step flow, and the important detail is where encryption happens.

1. Encrypt — You type or paste the secret. Encryption happens in your browser before anything leaves your machine.
2. Share — You get a unique one-time link. You can send it through any channel, because the decryption key never touches the server.
3. Expire — The secret self-destructs after it is viewed, or when the timer runs out. Nothing persists.

The practical consequence: the server stores ciphertext, not your secret. Even someone with access to the server cannot read the content without the key, which is why the link itself is the sensitive part — treat it like the secret.

What You Can Share

• Passwords
• API keys
• Files (file upload is supported)

Expiration Options

Configurable expiration is available at 1 hour, 1 day, or 1 week. One-time links are the default behavior described on the site: the secret is gone after the first view.

Who It Is For

Yopass targets the everyday habit of pasting credentials into chat and tickets. As the site puts it, secrets shared over Slack, email, and tickets "sit in plaintext — searchable forever, readable by anyone with access." Yopass replaces that with an encrypted link that disappears.

A concrete case: a developer needs to hand a staging database password to a contractor. Instead of a Slack DM that lives in history, they paste it into Yopass, set a 1-hour expiry, and send the one-time link. Once the contractor opens it, the secret is gone from the server.

Open Source vs. Business License

Both editions run on your own infrastructure. The difference is governance features and limits.

What the Business Features Do

• Secret Requests — Send a request link to a vendor or client who does not use Yopass; they upload the secret and you receive it encrypted.
• Read Receipts — Get notified by email or webhook the moment a one-time link is decrypted.
• Webhooks — Push security events (secret created, requested, or accessed) into your SOC or dev workflows.
• OpenID Connect Sign-In — Require users to authenticate through your OIDC provider before creating a secret.
• Audit Logs — Record events such as secret creation, access, and deletion without exposing secret contents.

Deployment Requirements

Yopass is designed for self-hosting. The site lists:

• Backend storage: Redis or Memcached
• Deployment: Docker and Kubernetes
• Source: available on GitHub, with community support through GitHub

If you already run Redis or Memcached and a container platform, the infrastructure fit is straightforward. If you do not, plan for that dependency before deploying.

How to Decide

Choose Yopass if:

• You want to self-host and keep control of the infrastructure.
• You need browser-side encryption with one-time, expiring links.
• You want an open-source tool with no vendor lock-in.

Choose the business license if:

• You need audit logs, read receipts, or webhooks for compliance or incident response.
• You want to collect secrets from external parties via request links.
• You need SSO enforcement through OpenID Connect.

Look elsewhere if:

• You want a fully managed service with no infrastructure to run — Yopass is built around self-hosting.
• You need features beyond the listed set; check the GitHub project for current capabilities before committing.

Getting Started

The site offers a demo and a "Get Started" path, plus the GitHub repository for self-hosting. The free tier is open source and free to self-host permanently; the business license is €149/year and still runs on your own infrastructure.