Yopass
With nearly 3,000 GitHub stars and active development since 2014 through version 14.2.0, Yopass eliminates the universal bad habit of sharing passwords and API keys through Slack messages, email threads, and ticket systems by encrypting secrets entirely in the browser using OpenPGP before anything reaches the server. The Go backend stores only ciphertext — it never sees plaintext — while the React frontend handles all encryption and decryption client-side, generating one-time URLs that self-destruct after a single viewing or when the configured expiration of one hour, one day, or one week passes. File upload support streams encrypted files with configurable size limits, and optional custom password protection adds a second encryption layer beyond the URL-embedded key. The server supports Redis or Memcached as storage backends with automatic key expiration, deploying via Docker Compose in under five minutes or as Kubernetes manifests for production environments. Built-in TLS support works alongside reverse proxy configurations for Nginx, Caddy, and Traefik with automatic Let's Encrypt certificate provisioning. Prometheus metrics expose HTTP request counts, latency histograms, and secret lifecycle counters for Grafana dashboard integration and alerting. Read-only mode enables split-instance deployments separating secret creation from retrieval across different network zones. Multi-language support localizes the interface for international teams. The open-source core under Apache 2.0 provides full self-hosted functionality with no account management required. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.
Benefits
- True End-to-End Browser Encryption
- OpenPGP encryption happens entirely in the browser before transmission — the server stores only ciphertext and never sees plaintext passwords, keys, or file contents.
- Self-Destructing One-Time Links
- Each secret generates a unique URL that automatically destroys itself after one view or when the configurable expiration of one hour, one day, or one week passes.
- Zero Account Management Required
- No user accounts, registration, or authentication needed for the open-source core — anyone with the link can decrypt while the server remains stateless and simple.
- Five-Minute Docker Deployment
- Docker Compose setup with Redis or Memcached backend deploys a production-ready instance in under five minutes with built-in TLS and automatic key expiration.
Features
- Encrypted File Sharing
- Upload and share files with streaming OpenPGP encryption in the browser, configurable size limits, and optional S3 or MinIO backend storage for larger payloads.
- Redis or Memcached Backend
- Choose between Redis and Memcached for encrypted secret storage with automatic TTL-based key expiration matching the configured secret lifetime.
- Prometheus Metrics Integration
- Built-in metrics endpoint exposes HTTP request counts, latency histograms, and secret lifecycle counters for Grafana dashboards and alerting rules.
- Split-Instance Read-Only Mode
- Separate secret creation from retrieval across different network zones with read-only mode for enhanced security in enterprise split-instance deployments.
- Multi-Language Interface
- Localized React frontend supports multiple languages for international teams sharing secrets across geographic regions and language boundaries.