Skip to content

Yopass

Secrets & Credentials

A zero‑account, end‑to‑end encrypted service for sharing secrets and files with one‑time URLs that auto‑expire.

Track releases GitHub Website
Go Latest 14.0.0 · 6d ago Security brief →

Features

  • End‑to‑end OpenPGP encryption performed in the browser
  • One‑time secret URLs that automatically expire
  • No user accounts or management required
  • Configurable expiration (hours, days, weeks)
  • Optional extra password protection for secrets

Recent releases

View all 3 releases →
Config change
14.0.0 New feature
Auth

Streaming file uploads

Open
13.1.0 New feature
Notable features
  • Read-Only Mode: --read-only flag disables secret creation endpoints while keeping retrieval active, allowing shared database between authenticated and public instances with a dedicated landing page.
  • Health Check Endpoints: /health for liveness checks and /ready for readiness checks, plus yopass-server health command to aid container orchestration.
  • Configurable Default Expiry: Deployments can set custom default TTL for secrets and file uploads.
Full changelog

✨ New Features

Read-Only Mode

  • Added read-only instance option for deploying separate public/protected instances
  • Read-only mode disables secret creation endpoints while keeping retrieval active
  • Allows sharing database between authenticated creation instance and public retrieval instance
  • Frontend displays dedicated read-only landing page when enabled
  • Enable with --read-only flag

Health Check Endpoint

  • Added /health endpoint for health checks
  • Added /ready endpoint for readiness checks (separate from health)
  • Includes dedicated yopass-server health command for monitoring
  • Separate health and readiness checks for better container orchestration support

Configurable Default Expiry

  • Added configurable default expiration time for secrets and file uploads
  • Allows customizing the default TTL per deployment
  • Comprehensive Playwright test coverage for expiry configuration

🐛 Bug Fixes & Improvements

Error Handling

  • Improved error handling in upload functionality
  • Added rendering fallback for upload component
  • Better handling of nil database scenarios

UI/UX Enhancements

  • Added visual feedback to copy buttons in Result component
  • Code formatting improvements across the codebase

Testing

  • Added Playwright E2E tests for read-only mode
  • Added comprehensive tests for default expiry configuration
  • Fixed configuration handling for non-boolean config values
  • Improved Viper config reset in test suite

📦 Dependency Updates

Multiple dependency updates including i18next, react-i18next, TypeScript ESLint, Node types, and various build tools to keep the project secure and up-to-date.

View release on GitHub
13.0.0 Breaking risk
Breaking changes
  • /create/secret introduced for secret creation; previous combined /secret endpoint now only reads secrets
Full changelog

The most notable change in this release is the separation of write endpoints introduced in #3309. Previously fetching and creating a secret happened on the same http endpoint which made it tricky to add access restrictions where you want your organization to be able to create secrets but the world to be able to access them. With this change a secret is accessed via the api on /secret but creation happen on /create/secret. This greatly simplifies oauth proxy setups with yopass. This is a breaking change for api users so have that in mind if you access yopass directly using api tools as those need to be updated as well.

New Translations added 👏

What's Changed

  • build(deps): bump react-i18next from 16.3.5 to 16.4.0 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3211
  • build(deps-dev): bump vite from 7.2.6 to 7.2.7 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3212
  • build(deps-dev): bump @types/node from 24.10.1 to 24.10.2 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3216
  • build(deps-dev): bump @vitejs/plugin-react from 5.1.1 to 5.1.2 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3215
  • build(deps): bump golang.org/x/crypto from 0.45.0 to 0.46.0 by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3217
  • build(deps-dev): bump typescript-eslint from 8.48.1 to 8.49.0 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3213
  • Fix multiple UI issues for secret display by @jhaals in https://github.com/jhaals/yopass/pull/3209
  • build(deps): bump openpgp from 6.2.2 to 6.3.0 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3218
  • build(deps): bump i18next from 25.7.1 to 25.7.2 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3214
  • build(deps): bump react-i18next from 16.4.0 to 16.4.1 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3219
  • build(deps-dev): bump daisyui from 5.5.8 to 5.5.11 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3220
  • build(deps-dev): bump tailwindcss from 4.1.17 to 4.1.18 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3223
  • build(deps-dev): bump daisyui from 5.5.11 to 5.5.13 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3227
  • build(deps-dev): bump @tailwindcss/vite from 4.1.17 to 4.1.18 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3226
  • build(deps-dev): bump autoprefixer from 10.4.22 to 10.4.23 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3228
  • build(deps): bump react-i18next from 16.4.1 to 16.5.0 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3230
  • build(deps-dev): bump eslint-plugin-react-refresh from 0.4.24 to 0.4.25 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3229
  • build(deps-dev): bump @eslint/js from 9.39.1 to 9.39.2 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3231
  • build(deps-dev): bump daisyui from 5.5.13 to 5.5.14 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3232
  • build(deps-dev): bump eslint from 9.39.1 to 9.39.2 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3233
  • build(deps-dev): bump vite from 7.2.7 to 7.3.0 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3235
  • build(deps): bump i18next from 25.7.2 to 25.7.3 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3236
  • build(deps-dev): bump typescript-eslint from 8.49.0 to 8.50.0 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3237
  • build(deps-dev): bump eslint-plugin-react-refresh from 0.4.25 to 0.4.26 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3239
  • build(deps): bump react-router-dom from 7.10.1 to 7.11.0 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3240
  • build(deps): bump react-hook-form from 7.68.0 to 7.69.0 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3241
  • build(deps-dev): bump typescript-eslint from 8.50.0 to 8.50.1 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3242
  • build(deps-dev): bump typescript-eslint from 8.50.1 to 8.51.0 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3244
  • build(deps): bump react-i18next from 16.5.0 to 16.5.1 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3245
  • feat: Add Czech translation (cs) by @vladimirandel in https://github.com/jhaals/yopass/pull/3222
  • build(deps-dev): bump @types/node from 24.10.2 to 25.0.3 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3238
  • build(deps-dev): bump globals from 16.5.0 to 17.0.0 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3246
  • build(deps): bump react-hook-form from 7.69.0 to 7.70.0 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3247
  • build(deps-dev): bump typescript-eslint from 8.51.0 to 8.52.0 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3248
  • feat(i18n): Add Polish translation (pl) by @pr0way in https://github.com/jhaals/yopass/pull/3243
  • build(deps-dev): bump vite from 7.3.0 to 7.3.1 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3249
  • build(deps): bump i18next from 25.7.3 to 25.7.4 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3250
  • build(deps): bump react-router-dom from 7.11.0 to 7.12.0 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3251
  • build(deps-dev): bump @types/node from 25.0.3 to 25.0.6 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3252
  • build(deps): bump react-hook-form from 7.70.0 to 7.71.0 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3253
  • build(deps): bump react-i18next from 16.5.1 to 16.5.2 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3254
  • build(deps): bump golang.org/x/crypto from 0.46.0 to 0.47.0 by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3257
  • build(deps-dev): bump @types/node from 25.0.6 to 25.0.8 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3258
  • build(deps): bump react-i18next from 16.5.2 to 16.5.3 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3259
  • build(deps): bump react-hook-form from 7.71.0 to 7.71.1 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3260
  • build(deps-dev): bump prettier from 3.7.4 to 3.8.0 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3261
  • build(deps-dev): bump typescript-eslint from 8.52.0 to 8.53.0 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3255
  • build(deps-dev): bump @types/node from 25.0.8 to 25.0.9 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3262
  • build(deps-dev): bump typescript-eslint from 8.53.0 to 8.53.1 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3263
  • build(deps): bump i18next from 25.7.4 to 25.8.0 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3264
  • build(deps-dev): bump prettier from 3.8.0 to 3.8.1 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3266
  • build(deps-dev): bump @types/node from 25.0.9 to 25.0.10 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3267
  • build(deps-dev): bump globals from 17.0.0 to 17.1.0 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3268
  • build(deps-dev): bump @playwright/test from 1.57.0 to 1.58.0 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3270
  • build(deps-dev): bump typescript-eslint from 8.53.1 to 8.54.0 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3272
  • build(deps-dev): bump globals from 17.1.0 to 17.2.0 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3273
  • build(deps): bump react-i18next from 16.5.3 to 16.5.4 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3274
  • build(deps): bump react-router-dom from 7.12.0 to 7.13.0 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3269
  • build(deps-dev): bump @types/node from 25.0.10 to 25.1.0 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3275
  • build(deps-dev): bump eslint-plugin-react-refresh from 0.4.26 to 0.5.0 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3277
  • build(deps-dev): bump @types/node from 25.1.0 to 25.2.0 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3279
  • build(deps-dev): bump @playwright/test from 1.58.0 to 1.58.1 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3280
  • build(deps-dev): bump globals from 17.2.0 to 17.3.0 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3278
  • build(deps-dev): bump autoprefixer from 10.4.23 to 10.4.24 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3281
  • build(deps-dev): bump daisyui from 5.5.14 to 5.5.17 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3283
  • build(deps-dev): bump @vitejs/plugin-react from 5.1.2 to 5.1.3 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3284
  • build(deps): bump i18next from 25.8.0 to 25.8.1 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3285
  • build(deps): bump i18next from 25.8.1 to 25.8.3 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3286
  • build(deps): bump i18next from 25.8.3 to 25.8.4 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3288
  • build(deps-dev): bump daisyui from 5.5.17 to 5.5.18 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3287
  • build(deps-dev): bump @types/node from 25.2.0 to 25.2.1 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3289
  • build(deps-dev): bump @playwright/test from 1.58.1 to 1.58.2 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3292
  • build(deps-dev): bump @types/node from 25.2.1 to 25.2.2 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3291
  • build(deps-dev): bump typescript-eslint from 8.54.0 to 8.55.0 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3293
  • build(deps): bump golang.org/x/crypto from 0.47.0 to 0.48.0 by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3294
  • build(deps-dev): bump @types/node from 25.2.2 to 25.2.3 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3295
  • build(deps-dev): bump @vitejs/plugin-react from 5.1.3 to 5.1.4 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3296
  • build(deps): bump i18next from 25.8.4 to 25.8.5 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3298
  • build(deps): bump i18next-browser-languagedetector from 8.2.0 to 8.2.1 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3300
  • build(deps): bump i18next from 25.8.5 to 25.8.6 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3299
  • build(deps): bump i18next from 25.8.6 to 25.8.8 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3302
  • build(deps-dev): bump typescript-eslint from 8.55.0 to 8.56.0 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3303
  • build(deps): bump i18next from 25.8.8 to 25.8.10 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3304
  • build(deps-dev): bump tailwindcss from 4.1.18 to 4.2.0 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3305
  • build(deps): bump i18next from 25.8.10 to 25.8.11 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3306
  • build(deps-dev): bump @types/node from 25.2.3 to 25.3.0 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3308
  • build(deps-dev): bump @tailwindcss/vite from 4.1.18 to 4.2.0 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3307
  • build(deps-dev): bump @eslint/js from 9.39.2 to 10.0.1 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3290
  • Change 'Télécharger' to 'Téléverser' in French locale by @cayenne17 in https://github.com/jhaals/yopass/pull/3301
  • build(deps): bump react-hook-form from 7.71.1 to 7.71.2 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3312
  • build(deps): bump i18next from 25.8.11 to 25.8.13 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3313
  • build(deps-dev): bump daisyui from 5.5.18 to 5.5.19 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3314
  • build(deps-dev): bump typescript-eslint from 8.56.0 to 8.56.1 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3315
  • build(deps): bump react-router-dom from 7.13.0 to 7.13.1 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3318
  • build(deps-dev): bump eslint-plugin-react-refresh from 0.5.0 to 0.5.2 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3319
  • build(deps-dev): bump tailwindcss from 4.2.0 to 4.2.1 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3317
  • build(deps-dev): bump @tailwindcss/vite from 4.2.0 to 4.2.1 in /website by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3316
  • Separate write/read endpoints for OAuth2 proxy support by @jhaals in https://github.com/jhaals/yopass/pull/3309
  • build(deps): bump minimatch and aws-cdk-lib in /deploy/cdk by @dependabot[bot] in https://github.com/jhaals/yopass/pull/3320
  • Update cdk stack by @jhaals in https://github.com/jhaals/yopass/pull/3321

New Contributors

  • @vladimirandel made their first contribution in https://github.com/jhaals/yopass/pull/3222
  • @pr0way made their first contribution in https://github.com/jhaals/yopass/pull/3243
  • @cayenne17 made their first contribution in https://github.com/jhaals/yopass/pull/3301

Full Changelog: https://github.com/jhaals/yopass/compare/12.5.0...13.0.0

View release on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

About

Stars
2,815
Forks
413
Languages
Go TypeScript JavaScript
View on GitHub Homepage Live demo

Install & Platforms

Install via
docker-compose docker

Similar tools

Teampass
Mybucks.online
aliasvault
passbolt_api
ots

Beta — feedback welcome: [email protected]