Yopass
End-to-end encrypted sharing of passwords, keys, and files. One-time URLs auto-expire. No accounts, no tracking.
Smart Download
Visit Project Homepage
No installer available yet — head to the source repository
Browser-encrypted, self-destructing secret sharing with no accounts or server-side plaintext.
Core Features
- End-to-end encryption via OpenPGP in the browser
- One-time viewing and auto-expiration (hours/days/weeks)
- File upload with streaming encryption
- No user accounts or tracking
- Self-hostable with Docker, Docker Compose, Kubernetes
What It Can't Do
- •Default backend Memcached loses data on restart; use Redis for persistence. 2. File upload limited to 1 MB by default; configure dedicated file store for larger files. 3. Must enable HTTPS in production (use Let's Encrypt with provided Docker Compose). 4. Once the recipient opens the link, the secret is shown and deleted immediately. 5. Public demo (yopass.se) is for testing only; self-host for sensitive data.
Use Cases
- Share database passwords or API keys with team members securely
- Send temporary credentials to support staff
- Exchange sensitive documents across organizations without email leak
Detailed Introduction
Yopass is an open-source tool for sharing sensitive information like passwords, API keys, and files. It encrypts data in your browser using OpenPGP before sending it to the server — the decryption key never leaves your machine. Each secret gets a one-time URL that automatically expires (configurable from hours to weeks). No user accounts, no logs, no plaintext storage on the server. Supports file upload with streaming encryption. Can be self-hosted via Docker, Docker Compose, or Kubernetes. Uses Memcached or Redis as backend. Also offers a command-line interface for automated sharing.
Troubleshooting & FAQ (1)
TroubleshootingHow do I stop antivirus software from clicking “Reveal Secure Message” and consuming a one-time Yopass secret?
Upgrade Yopass to a release containing the fix “require key entry before retrieving keyless text secrets.” In fixed versions, text secrets cannot be retrieved until the recipient submits a nonempty decryption key, even when status prefetch is enabled. This prevents antivirus scanners from following the link, clicking Reveal, and burning the one-time secret before the recipient opens it.
1. Update and redeploy Yopass with the fixed release/PR.
2. Send the secret link without the decryption key.
3. Transmit the decryption key through a separate channel.
4. Have the recipient enter the key before clicking “Reveal Secure Message.”
On older versions, use a temporary intermediate page that requires the user to enter the key before it calls the Yopass retrieval URL, or prevent scanners from prefetching the link.
Tags
Getting Started
Download installer
Click the button above to download the installer for your system
Install the software
Double-click the downloaded installer and follow the prompts
Step 1: Run `docker run -p 127.0.0.1:80:1337 --link memcached_yopass:memcached -d jhaals/yopass --memcached=memcached:11211`
Step 2: Open `http://localhost` in your browser, enter secret, set expiry
Step 3: Share the generated one-time URL; recipient views it once and it's gone
- Step 1: Run `docker run -p 127.0.0.1:80:1337 --link memcached_yopass:memcached -d jhaals/yopass --memcached=memcached:11211`
- Step 2: Open `http://localhost` in your browser, enter secret, set expiry
- Step 3: Share the generated one-time URL; recipient views it once and it's gone
Checksum not available
This project has not published a SHA-256 checksum on its GitHub Release page
SHA256 Checksum
No checksum available
Download directly from GitHub Releases and verify file integrity yourself
All SHA-256 checksums on this platform are extracted from the project's official GitHub Release page, without any modification. You can independently verify them on the GitHub Releases page.
Open Source Transparency
View GitHub SourceUninstall Info
If using Docker: `docker stop <container>` and `docker rm <container>`; remove persistent volumes. For Kubernetes: `kubectl delete -f deploy/yopass-k8.yaml`. For manual install: delete binary and config files.
No Extra Dependencies
Ready to use after download. No additional runtime required.
Having issues? Check the FAQ below
1 FAQ
Similar Projects
rustdesk
An open-source remote desktop tool built in Rust, designed for self-hosting. Compared to TeamViewer, it offers full data control and zero-config out-of-the-box, making it a privacy-focused alternative.
Immich
High performance self-hosted photo and video management solution with automatic backup, AI search, facial recognition, and multi-user support.
uBlock Origin
uBlock Origin is a wide-spectrum content blocker for Chromium and Firefox that is CPU and memory efficient. Blocks ads, trackers, miners, and malware out of the box.