Star on GitHub
Now in public betav1.0.0-beta.1

Secrets management,without the weight.

Yily is a fast, self-hosted home for your API keys, tokens and passwords. One Go binary, one SQLite file, AES-256-GCM at rest. None of the ceremony.

Star on GitHubSee how retrieval works
  • Single Go binary
  • One SQLite file
  • 10 languages
  • MIT licensed
yily.example.com/projects / acme / production
Encrypted at rest
Acme
Production
Live API and infrastructure secrets.
ImportExportNew variable
Search variables…
SortName ↑Date
Filterprodapidatabasemail
STRIPE_SECRET_KEY
prodapi
DATABASE_URL
proddatabase
JWT_SECRET
prodapi
SMTP_PASSWORD
prodmail
LEGACY_API_KEYNeeds value
– – – – –
Why Yily

Small by design.
Serious where it matters.

Yily started with a question: why does secret management need so much machinery?

The origin

The secret managers I tried were built for large teams. They came with clusters, agents, external databases, and a bill that grows with every environment. I wanted the opposite: one secure place for my keys, a deploy that takes a minute, and a footprint that costs little to run.

That constraint shaped the architecture: one Go binary, one SQLite file, one master key. Everything else had to earn its place.

Deployment

One binary. Zero orchestra.

The API, web interface and CLI ship together, with state in a single SQLite database. Deploy it next to your app. No external storage to run.

At rest

Encrypted, then stored.

Every value is sealed with AES-256-GCM and a fresh nonce. The master key never enters the database.

Versioning

History with an undo.

Every value change becomes a version. Reactivate an older one the moment a deploy goes sideways.

Access

Tokens that know their place.

Read- or write-scoped tokens, SHA-256 hashed before storage, revocable in one click. The raw token is shown exactly once.

Audit

Receipts, automatically.

Sign-ins, rotations and revocations are recorded with the actor, target and time. Export the trail when you need proof.

Localized in 10 languages
  • English
  • Français
  • Español
  • Deutsch
  • Italiano
  • Português
  • Русский
  • 中文
  • 日本語
  • 한국어
The retrieval path

A secret's journey,
end to end.

Yily was built around one job: getting a value from encrypted storage into your process without leaking it on the way. Here is every hop.

Auto-advancing · click a step to pauseThe bulk values endpoint is live today. SDK snippets on this page are design previews.
A secret's journey01 / 03
request responseplaintext never touches disk
SDKs

One API.
Every stack.

The REST API is live today. Thin, read-only SDKs are next: Go first, then Rust, Java, JavaScript and Python. Same single request, native types everywhere.

API design preview

First out of the gate. Struct tags map variable names, and one batched call fills the whole config.

main.goGo
type AppConfig struct {
	DBHost string `yily:"DB_HOST"`
	DBPort int    `yily:"DB_PORT"`
}

func main() {
	client, err := yily.NewClient(yily.Config{
		BaseURL:       "http://localhost:16529",
		EnvironmentID: "your-environment-uuid",
		Token:         os.Getenv("YILY_TOKEN"),
	})
	if err != nil {
		log.Fatal(err)
	}

	var cfg AppConfig
	if err := client.Load(context.Background(), &cfg); err != nil {
		log.Fatal(err)
	}
	log.Printf("db: %s:%d", cfg.DBHost, cfg.DBPort)
}
The API is taking shape in the open. Details may change before release.View the Go SDK
Read-only by designSDKs retrieve. Nothing writes.One batched requestEvery name, one round trip.Version pinningActive by default. Pin when you need.

Need it before the SDKs land? The batched read endpoint is available now, so you can use the REST API today .

Security model

Boring crypto.
Applied carefully.

Standard primitives, explicit context, zero cleverness. Secrets are encrypted before they touch SQLite; tokens are hashed before they are stored.

Encryption at rest

AES-256-GCM

Authenticated encryption with a fresh 96-bit nonce for every write and a 128-bit tag.

AEAD · hardware accelerated
Context binding

AAD verified

Ciphertext is bound to its variable ID and version. Swap it in SQLite and decryption fails closed.

yily:<variable>:<version>
Password hashing

Argon2id

Memory-hard hashing at the OWASP baseline, with a unique salt for every credential.

t=3 · m=64 MB · p=4
Tokens at rest

SHA-256

Sessions and personal access tokens are stored only as digests. Raw tokens are shown once.

hex(sha256(token))
Sessions

24h / 2h

Absolute and idle expiry. HttpOnly cookies, SameSite=Lax, and Secure whenever HTTPS is detected.

HttpOnly · Lax · Secure
Tenancy

Single admin

Self-contained authentication. No OAuth provider, no SMTP server, no third party in the loop.

single-tenant by design
Envelope anatomy

Every value carries its own proof.

The stored format is versioned, self-describing and context-bound. It is impossible to move a ciphertext to another variable or version without authentication failing.

Encryption spec Auth spec

Zero plaintext at rest. If the master key is lost, the ciphertext stays closed. Read the spec .

Self-hosting

Up in a minute.
Yours for good.

Generate one master key, start one container and open the dashboard. The API, the web interface and the data all stay on your infrastructure.

DockerThe recommended route. Pin the beta tag.Server binaryLinux amd64 tarball, web client included.CLIInstall yily-cli on Linux or macOS.

Guard the master key. If it is lost, the encrypted values are unrecoverable. That is by design. Store it outside the database and back it up.

bash · yily
1 Generate your master key
echo "YILY_MASTER_KEY=$(openssl rand -base64 32)" > yily.env
chmod 600 yily.env
1 Start the container
docker run -d --name yily \
  --restart unless-stopped \
  -p 16529:16529 \
  -v yily-data:/data \
  --env-file yily.env \
  ghcr.io/yannick2009/yily:1.0.0-beta.1
running/open localhost:16529

The current image is linux/amd64. On ARM, run it with--platform linux/amd64 until a native build ships.

Open source · MIT

Built in the open.
Yours to keep.

Audit every line, fork it if you disagree, and run it for as long as you like. No seats, no license ceiling, and no vendor holding the keys.

Star on GitHubContributing guide
v1.0.0-beta.1 MIT licensed Built in public
Clone the source
git clone git@github.com:yannick2009/yily.git
Releases Issues License
Contributors

We always need
more contributors.

A small group of people keeps Yily moving, and there is always room for one more. Fix a bug, polish a screen, or just tell us what feels broken.

Become a contributorBrowse open issues
FAQ

Fair questions.

Still curious? The source is public, the specs are in the repo, and the issue tracker is open.

Open an issueContributing guide
01Is Yily production-ready?

It is in public beta (v1.0.0-beta.1). The core works and is self-hostable today, but pin a release, back up the data volume and master key, and expect APIs to evolve. Read the release notes before upgrading.

02How is Yily different from Vault or Infisical?

Yily is deliberately small: one Go binary, SQLite, one admin and no external dependencies. If you need distributed clusters, dynamic secrets or multi-tenant RBAC, those tools are a better fit. If you want a vault you can understand in an afternoon, Yily is for you.

03What happens if I lose the master key?

The encrypted values become unrecoverable. There is no recovery path, by design. Generate the key once, store it outside the database and back it up somewhere safe.

04Which SDKs can I use today?

The REST API and CLI are available now. Go, Rust, Java, JavaScript and Python SDKs are on the roadmap, with Go first. The snippets on this page are design previews and may change before release.

05Does it run on ARM?

The current image is linux/amd64 only. On ARM hosts, Docker can emulate it by adding --platform linux/amd64. A native ARM build is not available yet.

06How can I contribute?

Open an issue, send a pull request or improve the docs. The contributing guide covers the workflow. Bug reports and documentation fixes count just as much as code.