WHAT IS IT?
Yopass is a self-hosted service for sharing secrets (passwords, API keys, tokens) without dumping them in plaintext into a Slack thread, an email or a ticket. The secret is encrypted right in the browser via OpenPGP before being sent: the server never sees the decryption key and only ever stores encrypted content. The recipient gets a one-time link that expires automatically.
WHY IS IT INTERESTING?
- Client-side encryption: everything happens in the browser via OpenPGP, the decryption key never reaches the server.
- One-time use + expiration: a secret is destroyed after it's read or once its TTL is up, no more credentials lingering in a chat history.
- No accounts, no tracking: no sign-up, no user accounts, no tracking. You share a link, that's it.
- Simple to self-host: deploys in minutes via Docker Compose or Kubernetes, with a Memcached (default) or Redis backend.
- Files and passwords: streaming encryption for file uploads and optional extra password protection.
USE CASES
- Hand a password or API key to a coworker without leaving a trace in a chat channel.
- Share temporary credentials without creating an account or permanent access.
- Distribute sensitive data in compliance-heavy environments.
- Run an internal instance to keep full control over where secrets are stored.