Yopass
Yopass shares secrets through one-time links. The secret is encrypted in the browser before it is sent, so the server only ever stores an opaque blob with an expiry, and the decryption key travels in the URL fragment which is never transmitted. Opening the link destroys the secret.
Yopass
In Development
This script is currently in active development and may be unstable or incomplete. Use in production environments is not recommended.
This script is currently in active development and may be unstable or incomplete. Use in production environments is not recommended.
Installation
Default install:
1
bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVED/main/ct/yopass.sh)"
Configuration
Config file:
1
/etc/systemd/system/yopass.service
Notes
Serve this over HTTPS. Encryption happens in the browser, and without a secure context the page cannot be trusted to do that - put it behind a TLS reverse proxy before using it for anything real.
Secrets live in the local Redis with a TTL and are gone once fetched or expired. Redis persistence is not configured, so a restart clears pending secrets - which is arguably the desired behaviour here.
Options are passed as flags in /etc/systemd/system/yopass.service and can equally be set as uppercase environment variables. Useful ones: --force-onetime-secrets, --disable-upload, --max-length.