Yopass Bundle

⭐ Found this useful? Give it a star on GitHub so more developers can find it.

Symfony bundle for Yopass-style E2E encrypted secret sharing: client-side libsodium encryption, expiration, read limits, and public reveal pages.

This bundle is FrankenPHP worker mode friendly.

Features

• Browser-side encryption (libsodium secretbox); server stores ciphertext only
• Text and file payloads (max 512 KB files; file tab requires file_handler service)
• Configurable expiration options, max-read limits, list pagination, and retention purge (nowo:yopass:purge-old-shares)
• Auto-generated decryption key or custom password mode
• One-click links via ?decrypt_key= query parameter; short links with manual key entry
• Authenticated manage UI + anonymous public reveal/consume routes
• Configurable routes, table prefix, templates, and pluggable access control
• Share events — customize list queries and per-share access (teams, grants, roles) without built-in ACL
• Public rate limiting — per-IP limits on anonymous /share/* routes (requires cache.app)

Installation

composer require nowo-tech/yopass-bundle

See Installation for Flex recipe, Doctrine schema, routes, and security firewall setup.

Configuration

# config/packages/nowo_yopass.yaml
nowo_yopass:
    user_class: App\Entity\User
    table_prefix: yopass_
    web_ui:
        layout_template: 'base.html.twig'   # optional: host admin layout
    security:
        # Defaults to ROLE_ADMIN since 1.3.0 — set explicitly if you need ROLE_USER
        access_roles: [ROLE_ADMIN]
        access_checker: App\Security\CustomYopassAccessChecker  # optional

Full reference: Configuration.

Usage

• Manage UI: /tools/yopass (configurable)
• Public reveal: /share/{id} or /share/{id}?decrypt_key=… (configurable)
• Override Twig: templates/bundles/NowoYopassBundle/

See Usage and Access control events.

Demo

make -C demo up-symfony8
# Demo started at: http://localhost:8022  →  Yopass CRUD at /tools/yopass (auto-login)

Documentation

• Installation
• Configuration
• PSR evaluation (REQ-CS-007)
• Usage
• Contributing
• Code of Conduct
• Changelog
• Upgrading
• Release process
• Security
• Engram
• Spec-driven development
• GitHub Spec Kit

Additional documentation

• GitHub Actions CI requirements
• Share list and access events
• Demo with FrankenPHP
• Local file storage (demo default)
• AWS S3 file shares example (local, gitignored)

Tests and Coverage

Current coverage: PHP 99%+ (statements via make coverage-check); TypeScript ~76% (lines — password-mode paths need browser sodium).

make test              # PHPUnit
make test-coverage     # PHP coverage + percentage script
make coverage-check    # PHP coverage + 99% statements gate
make test-ts           # Vitest (crypto)
make release-check     # Full pre-release chain

Language	Coverage
PHP	99%+ (Statements) — make coverage-check
TypeScript	~76% (Lines) — make test-ts (password-mode paths require browser sodium runtime)

License

MIT — see LICENSE.