Open-source secret sharing
Stop sharing passwords in Slack, email, and ticket systems. Yopass encrypts secrets in your browser and generates one-time links that auto-expire.
Trusted by engineers at
The problem
Passwords and API keys shared over Slack, email, and tickets sit in plaintext — searchable forever, readable by anyone with access. Yopass replaces that with three simple steps.
Type or paste your secret. It's encrypted in your browser with OpenPGP before anything leaves your machine.
Get a unique one-time link. Send it through any channel — the decryption key never touches the server.
The secret self-destructs after being viewed — or when the timer runs out. Nothing persists.
For teams & business
A clear audit trail and secure secret workflows across your entire organization — unlocked with a business license.
Receive credentials securely from vendors or clients who don't use Yopass. Send a request link, they upload the secret, and you receive it encrypted.
Know exactly when a secret is opened. Get notified by email or webhook the moment a one-time link is decrypted.
Push security events into your SOC or dev workflows. Trigger automated actions when secrets are created, requested, or accessed.
Put secret creation behind single sign-on. Require users to authenticate through your OpenID Connect provider before sharing.
Keep a non-repudiable record of sharing activity for compliance — who requested what and when, without ever exposing the secrets themselves.
Built for security
Designed so that following best security practices becomes the path of least resistance.
Encryption and decryption happen locally in your browser. The server never sees your plaintext data.
No sign-ups, no tracking, no cookies. Only the encrypted secret is stored — nothing else.
Audit the code, contribute features, or self-host with full confidence on your own infrastructure.
Pricing
Yopass is open source and free to self-host, always. The business license adds branding and higher limits — still running on your own infrastructure, because that's what makes it truly secure.
Everything in Open Source, plus: