CredenShare vs Yopass

The short answer

• Both encrypt in your browser, with the key in the link fragment.
• Yopass is open source (Apache-2.0), with a CLI and a hosted instance at yopass.se; a Business License (€149 a year) covers self-hosted extras.
• CredenShare adds access logs, teams, Secure Requests, SDKs for four languages, an MCP server and Slack.

Who this page is for: developers and teams comparing Yopass with a hosted credential-sharing service.

What does each tool do?

Yopass encrypts a secret in the browser with OpenPGP and gives you a link that expires after 1 hour, 1 day or 1 week, or after one view. It has a yopass command-line tool and file uploads, and runs with Docker and Redis or Memcached.

CredenShare sends and collects credentials through encrypted, expiring links, with an access log, teams and integrations.

Where is your secret encrypted?

• Yopass encrypts in the browser with OpenPGP; the key is in the URL fragment.

• CredenShare: Shares created in the web app, through the API or with the SDKs are encrypted in your browser or client with AES-256-GCM, using a key made for that share alone; the key travels in the part of the link after the #, which browsers don't send to servers. Shares created from Slack are the exception: they're encrypted on our servers.

CredenShare and Yopass side by side

Yopass details checked on October 23, 2026 against its own pages; see the sources below.

What does CredenShare add?

A record of every handoff

Each share logs the time and IP address of every view, kept for 3 to 180 days depending on your plan (not on Free). When someone says the credential never arrived, you can check.

Credentials coming back to you

Secure Requests (Business and Enterprise) send a form with the fields you choose. The submitter's browser encrypts each answer to a key belonging to the request, and you can require them to sign in with two-factor authentication.

SDKs and an MCP server

Official SDKs for Node, Python, Go and Rust, a REST API that refuses plaintext, webhooks, and an MCP server so AI assistants can create and expire shares and request secrets.

Teams and Slack

Teams with a shared allowance and optional zero-knowledge custody (Business and Enterprise), a Slack app (Plus and above), and a browser extension for Chrome and Firefox.

What does each cost?

Yopass is free and open source; the Business License is €149 a year, self-hosted. CredenShare: Free (3 shares a day); Solo $9.99/month (passcodes, access logs); Plus $49.99/month (5 seats, teams, Slack); Business $99.99/month (Secure Requests, API, IP allowlists). Yearly billing: $99.99, $499.99 and $999.99. See pricing.

Which should you use?

What to ask any secret-sharing tool before you trust it

1. Where is the secret encrypted? In your browser, or on the provider's servers after it arrives? Browser-side encryption means the provider never holds a readable copy.
2. Who holds the key? If it's in the link (after the #), the server can't decrypt without the link. If it's on the server, the provider can.
3. What happens to link previews? Email and chat scanners can open links. Can you allow two views, or start the clock at the first open?
4. Can you prove it arrived? Is there a record of each view, with a time and an IP address?
5. How long is data kept after expiry? What is deleted, and what metadata remains?
6. Can people send secrets to you? Without a request feature, credentials still arrive by email.
7. Where is it hosted, and can you self-host? That matters for data-residency rules.
8. Who on your team can see what? Admin visibility, team ownership, and what happens when someone leaves.

How do you switch from Yopass to CredenShare?

There's nothing to migrate: sharing links are short-lived by design.

1. Create a CredenShare account. The Free plan covers 3 shares a day.
2. Send your next credential with CredenShare: fill in the fields, set an expiry and a view limit, and add a passcode on a paid plan.
3. Invite your team (Basic and above), and add the Slack app, browser extension or SDKs you'll use.
4. Replace "send me your password" emails with Secure Requests (Business and Enterprise).
5. Let existing Yopass links expire on their own.

Where Yopass is the better choice

• Self-hosting with a small footprint.
• A simple CLI for one-off secrets.
• Free and open source.

Before you share a credential: a checklist

These apply whichever tool you use.

1. Send the link and the passcode through different channels. For example, the link by email and the passcode by text message.
2. Watch out for link scanners. Some email security filters and chat apps open links automatically, which can use up a one-view link. Send the link as plain text through a channel that doesn't pre-open links, or allow a second view with a short expiry.
3. Don't open the link to test it. On a one-view link, your test is the view.
4. Pick the shortest expiry that works. If you don't know when the recipient will act, a link that starts counting at the first open is safer than a long fixed window.
5. Rotate after the handoff when you can. The link expires, but the credential is still valid.
6. Keep the original in your password manager. A sharing link is a delivery method, not storage.

Verdict

Yopass is a lean, open-source tool for one-time secrets. CredenShare is the hosted option for teams that need logs, requests and developer and agent integrations.

Related: CredenShare vs PrivateBin · CredenShare vs OneTimeSecret · All comparisons

Sources (checked October 23, 2026):

• Yopass: yopass.se, GitHub
• CredenShare: encryption, plans and limits

Yopass is a trademark of its owner. CredenShare is not affiliated with it.