With nearly 3,000 GitHub stars and active development since 2014 through version 14.2.0, Yopass eliminates the universal bad habit of sharing passwords and API keys through Slack messages, email threads, and ticket systems by encrypting secrets entirely in the browser using OpenPGP before anything reaches the server. The Go backend stores only ciphertext — it never sees plaintext — while the React frontend handles all encryption and decryption client-side, generating one-time URLs that self-destruct after a single viewing or when the configured expiration of one hour, one day, or one week passes. File upload support streams encrypted files with configurable size limits, and optional custom password protection adds a second encryption layer beyond the URL-embedded key. The server supports Redis or Memcached as storage backends with automatic key expiration, deploying via Docker Compose in under five minutes or as Kubernetes manifests for production environments. Built-in TLS support works alongside reverse proxy configurations for Nginx, Caddy, and Traefik with automatic Let's Encrypt certificate provisioning. Prometheus metrics expose HTTP request counts, latency histograms, and secret lifecycle counters for Grafana dashboard integration and alerting. Read-only mode enables split-instance deployments separating secret creation from retrieval across different network zones. Multi-language support localizes the interface for international teams. The open-source core under Apache 2.0 provides full self-hosted functionality with no account management required. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Private text, encrypted before it leaves the browser: Enclosed turns passwords, keys, and other secrets into a link that only its holder can open, with no third-party service in between. Can the server read the note? No. It stores only ciphertext and settings, because the decryption key rides in the part of the link after the # sign, which browsers never send. Want a second lock? Add a password, or generate a random one with a click, and share it by another route. Worried about links lingering in chat history? Pick one hour, one day, one week, or one month, and tick Delete after reading so the first view removes the note, with a warning shown to the recipient beforehand. Need more than text? Attach files by button or drag and drop, and recipients download them one by one or all at once. Sending to a phone? Every finished note offers a QR code, downloadable as SVG or PNG. Setting it up for a team? Restrict note creation to signed-in users, create notes from the command line, and let people read the interface in 17 languages with light, dark, or system themes. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. Apache-2.0 licensed.

Credentials sitting forever in email threads and chat scrollback - Password Pusher solves that everyday security failure. Instead of pasting a password into Slack, you push it - a password, note, file, URL, or QR code - and share a unique one-time link that expires after a set number of views, a time limit, or both. Content is encrypted at rest with AES-GCM under a configurable master key, optionally guarded by a passphrase, and permanently deleted from the database the moment it expires; a retrieval-step option keeps URL-scanning bots from consuming views. Full audit logs record when each link was created and viewed (and by whom, with logins), and TOTP two-factor authentication can be required instance-wide. The delivery page is deliberately unbranded - no logos or confusing links for recipients - and the interface ships in 31 languages with light and dark themes. Automation runs through a JSON API (v2), an official CLI for pushing and expiring secrets from the terminal, a Chrome extension, and a catalog of third-party integrations. Apache-2.0 licensed Ruby on Rails, deployable via Docker, Kubernetes, or Helm, with SQLite or PostgreSQL storage - the sysadmin staple for sending credentials that clean up after themselves.

Only the person holding the link can open what you share with SkySend, a self-hosted file and note sharing service that encrypts everything in the browser before it leaves your device. Sending a contract? Drop in the file, several files, or a whole folder, and share the link. Need documents from a client? Send an upload link instead, and whatever comes back is encrypted for you alone. Handing over a password or an SSH key? Write it into a note that burns after reading. Notes can mix text, Markdown, generated passwords, and highlighted code in a single page. Every share can expire by time, stop after a set number of downloads or views, and carry an optional password as a second lock. The command-line client uploads, downloads, and reads notes with the same encryption, and its full-screen mode shows each link as a QR code. No accounts are needed: My Links keeps your shares in the browser, and optional OIDC sign-in limits who may create them. Encrypted uploads sit on local disk or any S3-compatible bucket, and the interface offers 13 languages and three themes. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

PrivateBin shares text and files with true zero-knowledge encryption: the server stores only ciphertext it cannot decrypt because the key exists exclusively in the URL fragment that never reaches the server. With over 8,400 GitHub stars and 500,000+ Docker pulls, it has become the standard for privacy-respecting paste sharing where not even the hosting operator can read stored content. All encryption uses 256-bit AES in Galois Counter mode performed entirely client-side in the browser. Burn-after-reading mode destroys pastes on first view, while configurable expiration timers automatically purge content after periods ranging from five minutes to forever. Optional password protection adds a second encryption layer requiring recipients to enter a passphrase before decryption occurs. Discussion threads enable anonymous or nickname-based commenting on pastes with IP-based identicon avatars for visual identity. Markdown rendering with live preview formats pastes as styled HTML, and syntax highlighting through prettify.js supports dozens of programming languages across four color themes. File upload support enables sharing images, PDFs, and media files with in-browser preview. QR code generation converts paste URLs for mobile device transfer. Customizable templates include Bootstrap 5, classic Bootstrap CSS, and Darkstrap themes. Storage backends support filesystem, MySQL, PostgreSQL, SQLite, Amazon S3, and Google Cloud Storage. Deploy via Docker with the privatebin/nginx-fpm-alpine image on port 8080. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. zlib licensed.

QuickDrop functions as an ephemeral, self-hosted file distribution node and pastebin that eliminates account requirements for rapid data transfers. Users can drag individual files, paste plain text code snippets, or drop entire folder structures while preserving complete directory hierarchies through automated client manifests. Resumable chunked transfers split multi-gigabyte payloads into resilient blocks, ensuring dependable uploads over unstable network connections. Senders can protect sensitive documents with optional AES encryption at rest, individual passphrase requirements, and automatic metadata stripping that removes GPS coordinates and camera EXIF markers. Granular share token policies restrict access by enforce maximum download quotas, burn-after-reading limits, or strict calendar expiration timestamps. In-browser viewers generate instant previews for code syntax, Markdown documentation, PDF reports, audio tracks, and high-resolution images without downloading files locally. Built-in QR code generators allow mobile devices to retrieve shared payloads instantly across local wireless networks. System operators can govern storage lifecycles through an administrative control panel with configurable retention windows, automated background garbage collection, and custom storage caps. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

Upload a file, get a unique download link and a separate delete link - Jirafeau has done exactly this one thing since 2008. It is plain PHP with no database, no mail server, no JavaScript framework, and no external dependencies - files and metadata live on the filesystem, which is why it runs on nearly anything and why it has outlasted most of its imitators. Uploads use the HTML5 file API, so PHP's post_max_size ceiling does not constrain file size, with live progress showing speed, percentage, and time remaining. Every upload takes options: expiration from one minute to a year to unlimited, self-destruct after first download, and password protection with configurable policy - passwords can be optional, required, or server-generated with complexity rules. Server-side encryption (modern builds use XChaCha20-Poly1305) stores files encrypted at rest with the decrypt key embedded only in the download URL, never on the server, so a compromised host cannot read the contents. Unencrypted deployments get file-level deduplication - identical files stored once with multiple links. Upload access can be gated by password lists or IP allowlists, a small admin panel manages stored files, and a CLI cleanup script handles expired files via cron. Recipients can preview supported files in-browser.

015 is a send-it-and-forget-it file sharing service for files that should exist for hours, not forever. Drop in a large file and it uploads in chunks, resuming where it stopped if the connection drops, while a short pickup code and a share link give the recipient two easy ways to collect it. If the same file was uploaded before, its hash gives it away and the transfer completes instantly without moving the data again. Every share carries your rules: an expiration time, a password, and a download count limit, enforced by signed download tokens so a shared link cannot be passed around indefinitely. Uploaded images can be compressed or converted in the background while you keep working, and text snippets share through the same expiring-link system when a file is overkill. Images and videos preview in the browser before downloading, and email or webhook notifications can tell you when a share is picked up. The interface speaks seven languages and answers just as well on a phone as on a desktop. When the window closes, a daily janitor sweeps expired files off the disk, so the server never quietly fills with forgotten uploads. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

A video too large for Discord, a secret that should not live in a chat log, or a config file a headless server needs to fetch: MicroBin turns each into a short link with an animal name, served from your own machine. Paste text or code and it comes back with syntax highlighting, inline image and video embedding, and a QR code for moving it to a phone. Attach one file or several, then decide exactly who can see them: uploads can be public or private, editable or locked, set to expire on a schedule or to never expire. For sensitive material, server-side encryption and client-side end-to-end encryption keep contents unreadable without the password. Raw serving hands the plain bytes to curl, a browser, or another program, which makes the same box a tiny file endpoint for scripts and test rigs. A postbox mode lets people send you files and texts they cannot browse or delete afterwards, and a read-only mode with an uploader password turns the instance into a drop point with exactly one trusted sender. The admin console lists uploads and storage, and everything runs as one small binary backed by SQLite or a JSON file, comfortable in a few megabytes of memory. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. BSD-3-Clause licensed.

Paaster is the pastebin for snippets too sensitive for a public paste site: every paste is encrypted in your browser before upload, so the server only ever stores ciphertext it cannot read. Paste code or logs and the text is sealed with libsodium the moment you stop typing, with the secret riding in the link fragment that browsers never send to a server. Share the link and only its holder can open the paste; share it as a QR code, or beam it to your other device with a five-minute code using Send to device. Set a paste to delete after its first view or after a chosen time, protect it with an access code, and let automatic language detection syntax-highlight the result. Your own pastes stay browsable in a local history, themes and keyboard shortcuts keep the editor fast, and drag-and-drop file sharing works the same encrypted way. Upload from the terminal with the companion CLI or the REST API, and store everything in MongoDB with MinIO, S3, or Cloudflare R2 holding the encrypted blobs. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. AGPL-3.0 licensed.

Share code snippets, logs, configs, and notes without registration, tracking, or ads: Lenpaste is a minimal, self-hosted, anonymous alternative to pastebin.com. It is deliberately spartan in the right ways: no accounts, no JavaScript required (the entire site works in text browsers and hardened setups), and cookies used solely to store display preferences. Pastes support syntax highlighting across a long list of languages (from ApacheConf and Arduino to mainstream stacks), configurable expiration from minutes to unlimited, one-use "burn after reading" pastes that self-delete on first view, optional author attribution, and iframe embedding for dropping pastes into other pages. The form-encoded HTTP API covers everything the UI does - create pastes with title, syntax, expiration, and line-ending normalization, fetch them by ID, and query server capabilities - making it trivial to pipe command output to your paste server from shell scripts. Server operators control maximum title and body lengths, maximum paste lifetime, rate limits for viewing and creation, search-engine indexing policy, and can lock private instances behind HTTP Basic authentication. It deploys as a single lightweight Docker container, giving your team a snippet-sharing endpoint where the content never touches a third-party service.

The Bitwarden server, reimplemented in Rust: Vaultwarden (formerly bitwarden_rs) is the unofficial lightweight edition. It speaks the same wire protocol as the official server, so every official Bitwarden client - browser extensions, iOS, Android, desktop, and the bw CLI - connects without modification, while the server itself runs as a single container against SQLite (or MySQL/MariaDB/PostgreSQL) instead of the official multi-container stack that wants gigabytes of RAM. Features Bitwarden gates behind paid tiers ship free: organizations with collections, groups, member roles, and policies; TOTP code storage; file attachments; Bitwarden Send; Emergency Access; event logs; and admin password reset. Two-factor options cover authenticator apps, email, FIDO2 WebAuthn, YubiKey, and Duo, and OIDC-based SSO landed natively in v1.35.0. Zero-knowledge encryption is unchanged - vault data is encrypted client-side and the master password never reaches the server. Attachments and Sends store on local disk or S3-compatible backends, an admin panel manages users and server settings, and backup is copying one data directory. Suited to individuals and teams up to roughly 50 users.

Security-conscious IT departments pick Passbolt for its cryptography: every user holds an OpenPGP key pair, and shared credentials are encrypted individually to each recipient's public key - real end-to-end encryption, not a vault password handed around. All crypto runs client-side in the mandatory browser extension (distributed and signed through the Chrome and Firefox stores, deliberately separating the crypto code from the server that stores ciphertext); private keys and passphrases never touch your instance, and the server admin cannot read a single secret. Authentication uses the challenge-based GpgAuth protocol, secrets are digitally signed to verify sender integrity, and metadata encryption extends protection to resource names and URLs. Day to day it behaves like a polished commercial manager: auto-fill and auto-save in forms, strong password generation, anti-phishing protection, TOTP storage, folder hierarchies shared per-user or per-group with fine-grained permissions and instant cryptographic revocation. Native iOS, Android, and desktop apps ship alongside a JSON API, CLI, and SDKs for CI/CD secret retrieval and rotation. The PHP server runs on MariaDB and is AGPL-licensed open source - including the paid tiers' codebase - with published security audits.

With over 36,000 GitHub stars and adoption by organizations including Adobe, Shopify, and Roblox, HashiCorp Vault is the industry-standard platform for secrets management, encryption services, and privileged access control across hybrid and multi-cloud infrastructure. The key/value secrets engine stores arbitrary secrets with full versioning, soft-delete, and metadata tracking, while dynamic secrets engines generate on-demand, short-lived credentials for AWS, Azure, GCP, databases including PostgreSQL, MySQL, MongoDB, and MSSQL, and SSH access with automatic revocation after configurable lease periods. The PKI secrets engine dynamically issues X.509 certificates on demand with automatic rotation and ACME protocol support, eliminating manual certificate management workflows entirely. Encryption as a service through the transit secrets engine lets applications encrypt, decrypt, sign, verify, and generate HMACs without managing cryptographic keys directly, supporting AES-GCM-256, ChaCha20-Poly1305, RSA-2048/4096, ECDSA-P256/P384, and ED25519 algorithms. Authentication integrates with LDAP, OIDC/OAuth2, SAML, AppRole for machine-to-machine access, Kubernetes service accounts, AWS IAM, Azure Active Directory, and GitHub tokens. Fine-grained ACL policies use path-based rules with glob patterns and sentinel policies for programmatic enforcement. The integrated Raft storage backend provides high-availability clustering without external dependencies, while alternative backends include Consul, S3, DynamoDB, PostgreSQL, and MySQL. The built-in web UI provides a visual interface for browsing secrets, managing policies, configuring auth methods, and monitoring cluster health. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. BSL 1.1 licensed.

API keys hardcoded in repos, database passwords pasted into CI variables, .env files emailed between developers - Infisical, the open-source platform for secrets, certificates, and privileged access management, is the answer to all three. Secrets live in versioned stores scoped by project, environment, and path, with fine-grained identity-aware access control and full audit logging on every read and change. Delivery covers every consumption pattern: CLI injection into local dev, SDKs for Go, Node.js, and Python, an HTTP API, agents, a Kubernetes Operator, and secret syncs that push to GitHub, GitLab, AWS Secrets Manager, and Vercel. Automatic rotation replaces credentials for PostgreSQL, MySQL, MSSQL, LDAP, AWS IAM, and Azure on a rolling schedule - new credentials issue while old ones stay temporarily valid, so nothing breaks mid-rotation. Dynamic secrets go further, generating ephemeral, time-bound database credentials on demand, and SSH access replaces static keys with short-lived CA-signed certificates that expire automatically. Secrets scanning catches hardcoded credentials in code and pipelines, certificate management automates X.509 issuance and renewal, and a built-in KMS handles encrypt/decrypt with central key control. Self-hosting keeps the keys to everything else on your own infrastructure.