A Yopass alternative for when you cannot self-host
The closest technical peer this service has — including the cases where the honest answer is to use Yopass.
Yopass is the closest thing to a technical peer this service has. It makes the same core choices we do, it is open source, and you can run it yourself. This page is a comparison, not a takedown — and on several points the honest answer is "use Yopass".
What Yopass does well
Yopass encrypts in the browser and keeps the key in the URL fragment. That is not a marketing claim you have to take on faith — it is visible in the source. website/src/shared/lib/crypto.ts runs OpenPGP in the browser, and Result.tsx builds the share link with the password after the #, which browsers never transmit in an HTTP request. Anyone can open those files and confirm it.
It is Apache-2.0 licensed and fully self-hostable, with Docker, Compose and Kubernetes manifests in the repository. Its own README recommends self-hosting for sensitive use. It requires no account, and the page that displays a secret carries a Content-Security-Policy of script-src 'self' 'wasm-unsafe-eval' — which structurally forbids third-party scripts on the page where your plaintext appears. That is the same reasoning behind our own policy, arrived at independently.
Yopass also runs a public vulnerability disclosure process. Two advisories were published in 2026, both resource-exhaustion issues affecting availability, both patched in 14.7.0. Neither breaks confidentiality. A project that publishes its own bugs is telling you more than one that has never published any.
If you can self-host, use Yopass. Apache-2.0, source-verifiable browser encryption, key in the fragment, no outside operator in the picture at all. That is a stronger position than any hosted service can offer, ours included, and it would be dishonest to structure this page to obscure it.
Side by side
Checked against the Yopass repository and its live hosted configuration endpoints on 30 July 2026. Re-check both columns yourself; software moves.
| Criterion | Yopass | notekill.com |
|---|---|---|
| Encryption in the browser | ✔ Yes — OpenPGP, verifiable in source | ✔ Yes — AES-256-GCM via the browser's Web Crypto API |
| Key kept in the URL fragment | ✔ Yes | ✔ Yes |
| Open source | ✔ Apache-2.0 | ✘ No — code hashes published at /integrity.json, but the source is not |
| Self-hostable | ✔ Yes — Docker, Compose, Kubernetes | ✘ No |
| Account required | ✔ No | ✔ No |
| Expiry options | 1 hour, 1 day, 1 week — three fixed choices | 10 minutes to 7 days, plus a view counter |
| View limit beyond one-time | ✘ One-time toggle only, no N-view counter | ✔ Yes — set how many opens are allowed |
| File size, hosted service | 128 KB and 512 KB on its two public endpoints | ✔ 25 MB, with filename and type encrypted too |
| File size, self-hosted | ✔ Configurable; 512 KB default, 1 MB without a licence key | — not applicable |
| Chat | ✘ No | ✔ Yes — ephemeral rooms (/chat) |
| Third-party scripts on the secret page | ✔ None — enforced by CSP | ✔ None — enforced by CSP |
| Price | ✔ Free; €149/year business licence for theming, OIDC, audit logs, webhooks | ✔ Free |
One thing we deliberately did not put in the table: whether the hosted Yopass demo logs IP addresses for the secret service. Its privacy policy describes the marketing website, which uses Google Analytics, but does not state a retention practice for the secret-handling service specifically. We could not confirm it either way, so we are not claiming it.
Where we differ, and why it might matter to you
The gap is not cryptographic — it is scope. Yopass is a focused tool for short secrets, and its hosted instances cap files at 128 or 512 KB. If you need to send a 12 MB scanned contract, or hold a short conversation rather than fire one message, this service carries those; Yopass does not.
The second difference is what happens if you cannot self-host. Yopass's strength is the option to run it yourself. If that option is closed to you — no server, no ops capacity, needed today — then you are using someone's hosted instance, and at that point the questions become who terminates TLS, what is logged, and what you can check. Those are the questions this service is built to answer: nothing readable is stored, TLS terminates on the server we run with no CDN in front of it, the operator is named in full on /legal, and /verify lets your browser check the code it was served.
Every hosted service in this category shares one residual risk, and we are no exception: the encryption code is delivered by the server on each visit, so whoever controls that server could in principle serve altered code to future visitors. Published hashes and a strict CSP make that detectable, not impossible. Yopass's answer — run it yourself — genuinely removes this. Ours only narrows it. Full write-up on /security.
Try it
Write a note at notekill.com, or read how to choose between these tools first. Other comparisons: Privnote, Onetime Secret, Password Pusher.