See when a secret was opened
A read receipt turns from Not opened to Opened, with the exact time. The recipient sees nothing extra.
Secret sharing for teams
Yopass encrypts a password, key or file in your browser and returns a one-time link. Self-hosted and open source since 2014.
1Your secret, in your browser
DATABASE_URL=postgres://app:[email protected]:5432/prod
2What the server keeps
-----BEGIN PGP MESSAGE----- wy4ECQMIq0vN2c8Jd7Xg5uRkT1pZ8aQeYb3s0sABAdZ3fLmYw9eHhK2oVbC4nQx7TtGm1rUuE6yWcD0iPj5NhQ2mZ7cLxV0aRk8sEwBt3gYd
3The link you send
https://share.yopass.se/#/s/8f1c0d6a-41be-4c3e-9a7d-2b5e10f4c681/kR7wPz3LmQx9Tb2VnH4sYd
- The record ID, fetched once and then deleted
- The key, after the #, which never reaches the server
A password pasted into Slack, email or a ticket stays there, searchable by everyone with access. A Yopass link opens once, and then the server deletes what it held.
Teams using Yopass
Yopass for the sender and the recipient
Paste the secret, choose one hour, one day or one week, and press Encrypt. The recipient opens the link once, and the server has nothing left to show.
Try the demoEncrypt message
Your Secret
DATABASE_URL=postgres://app:[email protected]:5432/prod
Deleted automatically after
One HourOne DayOne Week
One-time download
Generate decryption key
Read receipt (track when the secret is opened)
Encrypt Message
Decrypted Message
This secret will not be accessible again. Make sure to save it now!
DATABASE_URL=postgres://app:[email protected]:5432/prod
Copy to ClipboardShow QR Code
The server only stores ciphertext
Your browser encrypts with OpenPGP before anything is sent. The key travels in the link, in the part a browser never sends to a server. Yopass deletes the ciphertext on first read or when its time runs out.
Read the source on GitHubRequest a secret from anyone
-
Create a secret request
Your browser makes a key pair. The public key goes to the server and the private key never leaves your browser.
-
Send the link for the secret
Chat, email or a support ticket will do. The responder needs no account and installs nothing.
-
Collect the secret once
Their answer is encrypted in their browser and decrypted in yours. The server deletes it as you open it. Part of the business license.
A record of every secret. Who opened it, who signed in, and when.
Put sign-in before sharing
OpenID Connect with your own provider. Only signed-in users from your email domains create secrets.
OIDC_ISSUER=https://accounts.google.com
OIDC_CLIENT_ID=123456789-abc.apps.googleusercontent.com
OIDC_CLIENT_SECRET=GOCSPX-…
OIDC_REDIRECT_URL=https://yopass.example.com/auth/callback
OIDC_ALLOWED_DOMAINS=example.com
OIDC_REQUIRE_VERIFIED_EMAIL=true
Log every secret event as NDJSON
Creation, access and deletion are written one JSON object per line, never with the secret itself.
2026-04-09T12:00:00Z{"event":"auth.callback_success","outcome":"success","client_ip":"203.0.113.42"}
2026-04-09T12:00:01Z{"event":"secret.created","outcome":"success","secret_id":"3a128f193823","one_time":true,"expiration_seconds":3600}
2026-04-09T12:01:00Z{"event":"secret.accessed","outcome":"denied","secret_id":"3a128f193823","error":"authentication required"}
2026-04-09T12:03:27Z{"event":"secret.accessed","outcome":"success","secret_id":"3a128f193823","client_ip":"203.0.113.42"}
2026-04-09T12:03:31Z{"event":"secret.receipt_checked","outcome":"success","secret_id":"3a128f193823"}
2026-04-09T12:10:12Z{"event":"file.uploaded","outcome":"success","secret_id":"9c41d7e02b6a","one_time":true}
2026-04-09T12:14:40Z{"event":"file.downloaded","outcome":"success","secret_id":"9c41d7e02b6a"}
2026-04-09T12:20:05Z{"event":"secret.created","outcome":"success","secret_id":"b20f6a913d07","one_time":true}
2026-04-09T12:21:19Z{"event":"secret.deleted","outcome":"success","secret_id":"b20f6a913d07"}
2026-04-09T12:30:00Z{"event":"auth.logout","outcome":"success"}
Post secret events to your systems
Webhooks send created, viewed and expired events to an HTTP endpoint you control, as they happen.
Yopass runs on your own servers
Yopass is one Go server with Redis or Memcached behind it. Docker Compose starts both in under five minutes, and Kubernetes works as well. Secrets stay on infrastructure you control.
- Apache-2.0 license
- 3,237 stars on GitHub
- Public since January 2014
services:
yopass:
image: jhaals/yopass:latest
ports:
- "1337:1337"
environment:
MEMCACHED: memcached:11211
FORCE_ONETIME_SECRETS: "true"
depends_on:
- memcached
memcached:
image: memcachedOne image holds the server and the web app.
Pricing
Both plans run on your own infrastructure: Docker or Kubernetes, with Redis or Memcached for storage.
Open source
For anyone who wants to run the server.
FreeApache-2.0
Get the source
- The full server and web app
- The yopass command-line client
- File uploads up to 1 MB
- Translated interface
- Community support on GitHub
Business license
For teams that need sign-in and a record.
€149/ year, self-hosted
- Secret requests
- Read receipts
- Webhooks
- Audit logging
- OpenID Connect sign-in
- Your own logo, colours and name
- File uploads over 1 MB
Can the Yopass server read a secret?
No. The browser encrypts it first. The server stores ciphertext and never receives the key.
What happens after a secret is opened?
A one-time secret is deleted on first read. Every other secret is deleted when its lifetime ends.
Does the recipient need a Yopass account?
No. They open the link in a browser.
Is there a hosted Yopass?
No. You run it on your own servers. The public demo is for trying it.
What does a license add to Yopass?
Secret requests, read receipts, webhooks, audit logging, OpenID Connect sign-in, theming and larger uploads.