README

⭐ Found this useful? Give it a star on GitHub so more developers can find it.

Symfony bundle for Yopass-style E2E encrypted secret sharing: client-side libsodium encryption, expiration, read limits, and public reveal pages.

This bundle is FrankenPHP worker mode friendly.

Manage page — create panel, shares list, row actions (UiKit list scaffold)

Encrypted share created — short link, key and one-click link

Recipient reveals the one-time secret, decrypted in the browser

Features

• Browser-side encryption (libsodium secretbox); server stores ciphertext only
• Text and file payloads (max 512 KB files; file tab requires file_handler service)
• Configurable expiration options, max-read limits, list pagination, and retention purge (nowo:yopass:purge-old-shares)
• Auto-generated decryption key or custom password mode
• One-click links with the key in the URL fragment (#decrypt_key=, never sent to the server; sharing.allow_embed_in_url); short links with manual key entry
• Authenticated manage UI + anonymous public reveal/consume routes, on the UiKit page contract (list / show scaffolds, guest layout, one host theme for every Nowo bundle; no bundle layout, CSS framework or CDN)
• Configurable routes, table prefix, templates, and pluggable access control
• Share events — customize list queries and per-share access (teams, grants, roles) without built-in ACL
• Public rate limiting — per-IP limits on anonymous /share/* routes (requires cache.app)

Installation

composer require nowo-tech/yopass-bundle

See Installation for Flex recipe, Doctrine schema, routes, and security firewall setup.

Configuration

# config/packages/nowo_yopass.yaml
nowo_yopass:
    user_class: App\Entity\User
    table_prefix: yopass_
    security:
        # Defaults to ROLE_ADMIN since 1.3.0 — set explicitly if you need ROLE_USER
        access_roles: [ROLE_ADMIN]
        roles: { create: [ROLE_ADMIN], list: [ROLE_ADMIN], revoke: [ROLE_ADMIN] }
        access_checker: App\Security\CustomYopassAccessChecker  # optional

# Pages render inside your layouts and theme, configured once in UiKit for every Nowo bundle
nowo_ui_kit:
    css_framework: bootstrap5
    layouts: { admin: 'layouts/admin.html.twig', guest: 'layouts/guest.html.twig' }

Full reference: Configuration.

Usage

• Manage UI: /tools/yopass (configurable)
• Public reveal: /share/{id} or /share/{id}#decrypt_key=… (configurable)
• Pages, view models and data blocks: Templates; override Twig: templates/bundles/NowoYopassBundle/ (prefer the UiKit theme)

See Usage and Access control events.

Demo

make -C demo up-symfony8
# Demo started at: http://localhost:8022  →  Yopass CRUD at /tools/yopass (auto-login)

The screenshots at the top of this README come from this demo (fake demo text only); refresh them with make -C demo/symfony8 demo-screenshots (make -C demo/symfony8 test-e2e runs the Playwright happy path).

Documentation

• Installation
• Configuration
• Usage
• Templates (UiKit page contract)
• Contributing
• Code of Conduct
• Changelog
• Upgrading
• Release
• Security
• Engram
• Spec-driven development
• GitHub Spec Kit

Additional documentation

• PSR evaluation (REQ-CS-007)
• GitHub Actions CI requirements
• Share list and access events
• Demo with FrankenPHP
• FrankenPHP worker audit
• Local file storage (demo default)
• AWS S3 file shares example (local, gitignored)

Tests and Coverage

PHPUnit (unit + integration with Doctrine ORM/SQLite and MongoDB mocks) and Vitest (libsodium crypto helpers and Stimulus controllers on happy-dom). Both gates fail the build below their threshold.

make test              # PHPUnit
make test-coverage     # PHP coverage + percentage script
make coverage-check    # PHP coverage + 99% statements gate
make test-ts           # Vitest + coverage (all TS sources, 90% gate)
make release-check     # Full pre-release chain

License

MIT — see LICENSE.