Yopass

A decryption key the server never receives

Yopass is a self-hosted Go service for getting a password, an API key or a file to someone without it sitting readable in an inbox or a chat log. The browser encrypts the secret with OpenPGP under a random key and uploads only the ciphertext. The key stays in the URL fragment, the part after # that browsers do not send to the server, so the server holds data it cannot read and the recipient decrypts it locally.

Keys sent separately and a retrieval-only public instance

• Read once, or until expiry: 1 hour, 1 day or 1 week. --allow-custom-expiration needs no license and accepts anything from 1 minute to 90 days with the default bounds.
• The key can travel on another channel. Since 15.0.0, a link without its key waits for the recipient to type the key in before downloading anything. The change targets email security scanners that click through links and burn one-time secrets.
• An optional password can sit on top of the key, and --argon2 switches its derivation from iterated SHA-256 to memory-hard Argon2id, which holds up better against GPU brute force.
• --read-only turns an instance into a retrieval-only front door. Point it at the same Memcached or Redis as an internal instance behind the VPN, and people outside can open secrets that only staff can create.
• The yopass CLI shares text and files from the terminal, with prebuilt binaries for Linux, macOS and Windows that need neither Docker nor Go.

Memcached or Redis required, 1 MB files without a license

Memcached or Redis is mandatory, and Memcached can lose a secret before it expires. Secrets and file metadata live in one of the two, Memcached by default; only the encrypted file blobs can move to disk or an S3 bucket. The docs warn that Memcached may evict unexpired secrets under memory pressure, so an expiry caps a secret's lifetime without guaranteeing it.

Production requires HTTPS, so that neither the web app nor the ciphertext can be altered in transit, the README explains. A reverse proxy that overwrites the Content-Security-Policy header has to keep 'wasm-unsafe-eval', or the browser can silently fail to decrypt Argon2id-protected secrets.

Unlicensed, files stop at 1 MB and nobody signs in. --max-file-size defaults to 512 KB and cannot go past 1 MB without a license key. The open source edition has no accounts or login, so the docs keep creation in-house at the network level, with the read-only split above. The Business license costs €149 a year for an instance you host yourself and adds OpenID Connect, audit logging, read receipts, signed webhooks and larger uploads, among others. Those features sit in the same codebase and unlock with the key. When the key expires, the server turns them off without a restart but keeps existing OIDC sessions and the login requirement in force.

The CLI talks to the project's public API by default, https://api.yopass.se, until --api and --url point elsewhere, even though the README recommends running your own instance for anything sensitive. It does not work against installations protected by OpenID Connect.

16.0.1, out on 23 October 2026, closes a run of ten releases since 19 July. 16.0.0 landed on 17 October, eight days after 15.0.0: it fixed 27 security findings, 15 rated medium and 12 low, and changed how several APIs behave, which is why the major number moved again. Yopass first shipped in 2014.