Yopass

[MickLesk]

Name of the Script

Yopass

Script Type

CT (LXC Container)

Does this script support arm64?

arm64 supported

📋 Script Details

Yopass shares secrets through one-time links. The payload is encrypted in the browser, so the server only stores an opaque blob with a TTL, and the key travels in the URL fragment which never reaches the server. Requested in discussion #3097.

• Two builds, taken from the upstream Dockerfile: go build ./cmd/yopass-server for the binary, and yarn install && yarn build in website/ for the frontend. The frontend is not embedded — go:embed appears only in pkg/server/license.go — so the server is started with --asset-path /opt/yopass/website/dist.
• Redis as backend rather than the default memcached: one less moving part, and it matches what other scripts here already use. --database redis --redis redis://127.0.0.1:6379/0.
• --address 0.0.0.0 is explicit; the flag defaults to empty.
• Note: this belongs behind TLS. Encryption happens in the browser and a non-secure context undermines the entire premise — flagged as the first warning in the JSON.
• Redis persistence is deliberately not configured: a restart dropping pending secrets is the desired behaviour for a one-time-secret service.

Source: https://github.com/jhaals/yopass

[github-actions]

The Yopass script is ready for testing:

bash -c "$(curl -fsSL https://github.com/community-scripts/ProxmoxVED/raw/main/ct/yopass.sh)"

Serve this over HTTPS. Encryption happens in the browser, and without a secure context the page cannot be trusted to do that - put it behind a TLS reverse proxy before using it for anything real.
Secrets live in the local Redis with a TTL and are gone once fetched or expired. Redis persistence is not configured, so a restart clears pending secrets - which is arguably the desired behaviour here.
Options are passed as flags in /etc/systemd/system/yopass.service and can equally be set as uppercase environment variables. Useful ones: --force-onetime-secrets, --disable-upload, --max-length.

Note: This is not in the official repo yet—it's just a dev version! After merging into ProxmoxVE, it will need to be recreated.

Discord testing thread: https://discord.com/channels/1302816934508630047/1534101388827820133