Compare

ProtectedShare vs Yopass

Yopass and ProtectedShare start from the same idea: your browser encrypts the secret, and the key travels in the link after the #. Yopass is built to be self-hosted. ProtectedShare also runs as a hosted service, and its read counts, 25 MB file drops and secret requests are free.

Create a secure note Share a .env file

Yopass and ProtectedShare, feature by feature. Each answer is Yes, No, Partial or Not stated.
Feature	Yopass	ProtectedShare
Encrypts in your browser before upload
Encrypts in your browser before upload	YesOpenPGP; the key is in the link after #	YesAES-256-GCM via Web Crypto, before upload
One-time links
One-time links	YesOne-time by default	YesNotes can burn after the first read
Expires after a set time
Expires after a set time	Yes1 hour, 1 day or 1 week; up to 90 days if the operator allows custom times	Yes1 hour to 30 days
Allow a set number of reads
Allow a set number of reads	NoOne view, or any number until it expires	YesEnvShare: 1 to 100 reads
Optional password
Optional password	Yes	YesOr keep the key in the link
Encrypted file sharing
Encrypted file sharing	Partial512 KB by default, 1 MB at most without a license	YesUp to 25 MB, with a download limit
Ask someone to send you a secret
Ask someone to send you a secret	PartialWith a paid business license	YesEncrypted to your public key
See whether it was opened
See whether it was opened	PartialRead receipts, with a paid business license	PartialOpened status and revoke in My links, on the device that made the link
Hosted for you
Hosted for you	PartialA public demo; their README says to self-host for sensitive data	Yesprotectedshare.me
Open source
Open source	YesApache 2.0	YesMIT license
Self-hostable
Self-hostable	YesDocker or Kubernetes, with Memcached or Redis	YesCloudflare Worker + D1, Docker web image
Works without an account
Works without an account	Yes	Yes

The Yopass column reflects their public docs and site at time of writing (October 2026). Products change, so check theirs before deciding. Sources: Yopass on GitHub, yopass.se, server options, file storage docs.

The same core idea

Yopass generates a random key, encrypts the secret in your browser with OpenPGP, and puts the key in the URL fragment, which isn't sent to the server. The server stores the encrypted message with an expiry, and removes a one-time secret after its first retrieval.

ProtectedShare does the same with AES-256-GCM through Web Crypto. One addition: HKDF splits your key into an encryption key and an auth token, and the server releases the ciphertext only to a browser that presents the token. A guessed link id gets nothing.

For password-protected secrets, Yopass uses iterated SHA-256 by default and can switch to memory-hard Argon2id if the operator turns it on. ProtectedShare uses PBKDF2-SHA256 at 600,000 iterations.

What costs extra

Yopass's open-source edition is free to self-host. A business license (€149 a year at time of writing) adds secret requests, read receipts, file uploads over 1 MB, OpenID Connect sign-in, audit logs, webhooks and custom branding.

ProtectedShare has no paid tier for individuals. File drops up to 25 MB, secret requests and the opened status in My links are free on the hosted site, and the MIT-licensed code includes all of it if you run your own copy.

Hosted or self-hosted

Yopass's README calls its public demo useful for testing and says to self-host your own instance when sharing sensitive information. That is a fair stance for any tool where the server delivers the encryption code: whoever runs the server could change it.

ProtectedShare runs protectedshare.me as the service itself, and you can still self-host. The API is a Cloudflare Worker with a D1 database, and the web app ships as a Docker image. The self-host guide walks through it, and the security page lists what the server stores.

Try it on ProtectedShare

Free, with no account. Each tool encrypts in your browser before anything is uploaded. The security model lists exactly what the server stores.

Questions

Is Yopass free?

The open-source edition is free to self-host under the Apache 2.0 license, and there's a public demo at share.yopass.se. A paid business license adds features such as secret requests, read receipts and file uploads over 1 MB. ProtectedShare's hosted tools are free with no sign-up, and its MIT-licensed code includes every feature.

Does Yopass encrypt secrets in the browser?

Yes. Its README says Yopass encrypts the secret in your browser with OpenPGP and puts the decryption key in the URL fragment, so the server stores only the encrypted message. ProtectedShare does the same with AES-256-GCM through Web Crypto.

Can Yopass share files?

Yes, small ones. The default limit is 512 KB, and it's capped at 1 MB without a license key. ProtectedShare's file drop encrypts up to 25 MB per drop in your browser, with 1 to 100 downloads.

How long can a Yopass secret last?

The standard choices are one hour, one day or one week. An operator can allow custom durations from 1 minute to 90 days. ProtectedShare offers 1 hour, 1 day, 7 days or a custom date up to 30 days.

Do I have to self-host Yopass?

You can try the public demo, but Yopass's README recommends self-hosting your own instance when sharing sensitive information. ProtectedShare runs a hosted version at protectedshare.me, and you can self-host it too.