[opensourcedex]

PasswordPusher is a free, open source file management & sync project written in Ruby and released under Apache-2.0. It has 3,202 GitHub stars, 460 forks and 105 open issues, and was last pushed yesterday. On this registry it ranks #30 of 42 tracked projects in File Management & Sync, with 5 head-to-head comparisons available.

What is PasswordPusher?

PasswordPusher is an Apache-2.0-licensed Ruby web application for sharing passwords, notes, files and URLs as self-deleting links that expire after a set number of views or a set duration, with audit logs recording who viewed what, and when.

What it is

PasswordPusher is a web application, written in Ruby and released under the Apache-2.0 licence, that shares sensitive information through links which destroy themselves. A user pushes a password, a note, a file or a URL into the application, and the recipient receives a one-time link that expires after a set number of views, a set duration, or both. The secret is stored encrypted and removed entirely once expired, and a passphrase can be required before the link opens. Version 2.0 is the current release.

The problem it solves is the habit of sending secrets over chat or email, where they persist in inboxes, message histories and backups with no record of who read them. PasswordPusher replaces that channel with an expiring link and an audit trail showing when a link was created and viewed and, when logins are enabled, by whom. It belongs to the Ruby and self-hosted tooling ecosystem, and the registry places it in Productivity & Utilities / File Management & Sync.

Key capabilities

  • Encrypted storage at rest, with sensitive data deleted on expiry; links expire by views, by time, or both, and can require a passphrase.
  • Audit logging that records when links were created and viewed, and identifies the viewer when optional logins are enabled.
  • Two-factor authentication through TOTP authenticator apps with backup codes, enforceable instance-wide by administrators with PWP__REQUIRE_MFA=true.
  • One-command Docker Compose deployment with automatic SSL/TLS, on a database for persistence or the stateless pglombardo/pwpush-ephemeral image; Kubernetes and Helm are also supported.
  • A JSON API, an official CLI and a Chrome Extension, plus third-party integrations listed at docs.pwpush.com/docs/3rd-party-tools/.
  • White-label branding through environment variables: custom theme, logo, site name and CSS, with 26 Bootswatch themes and light/dark following the system preference, managed from a built-in admin dashboard.
  • An interface available in 31 languages, with an unbranded delivery page free of logos, superfluous text and unrelated links.

Who uses it and how

  • Managed service providers and IT and network security teams, reflected in the msp, netsec and information-technology topics, share credentials with clients and colleagues without leaving them in chat or mail history.
  • Self-hosters run the Docker image beside their own database, or the ephemeral image when nothing should persist, on Docker, Kubernetes, Helm or cloud infrastructure.
  • Organisations that enable logins gain an audit trail naming who viewed each shared secret, which suits teams that must answer who saw what, and when.
  • Administrators can require MFA across the instance so every account uses an authenticator app, while teams that prefer not to operate anything can use the hosted service at pwpush.com.

Getting started

Self-hosting begins with the one-command Docker Compose deployment, which includes automatic SSL/TLS, using the published pglombardo/pwpush image, with pglombardo/pwpush-ephemeral as a database-free alternative. Documentation is at docs.pwpush.com, and a free hosted instance runs at pwpush.com.

How it compares

The facts name no commercial products that PasswordPusher replaces, and no comparable tools either, so it stands alone in this registry. Within these facts its distinguishing feature is deployment choice: the same Apache-2.0 codebase can be used as the hosted service at pwpush.com, self-hosted under Docker, Kubernetes or Helm, or run under a paid Self-Hosted Pro plan.

When to use it — and when not to

Self-hosting means operating a Ruby web application, a database where persistence is wanted, TLS as handled by the Compose setup, and the added support load of enforced MFA; teams unwilling to run that should use the hosted service or a paid plan instead. Existing installations moving to 2.0 must work through the migration and configuration changes in UPGRADE-2.0.md rather than dropping in the release, and details of who viewed a link exist only when logins are enabled. The repository carries 105 open issues, worth weighing by anyone expecting a quiet, settled project.

project readme (upstream, from github) — read inline

Password Pusher

Share passwords, text, files & URLs securely with self-deleting links and full audit logs.

Try it free Documentation

Docker pulls Docker pulls License

GitHub stars

v2.0 is released. If you already self-host, see the upgrade guide for migration notes and configuration changes.

What is Password Pusher?

Password Pusher is an open source web app for sharing sensitive information safely. You push a password, note, file, or URL; the recipient gets a one-time link that expires after a set number of views and/or time. No more sending secrets over chat or email—encrypted, auditable, and auto-self-destruct.

Use the hosted service or run your own instance with Docker in minutes.

Why Password Pusher?
🔒 Secure by default Encrypted storage, optional passphrase, expiry by views and/or time. Sensitive data is removed entirely once expired.
📋 Full audit trail See when links were created, viewed, and by whom (with logins).
🏠 Self-host or use hosted Use pwpush.com or deploy your own—Docker, Kubernetes, Helm, or cloud.
🌐 Ready for teams 31 languages, light/dark theme, JSON API, official CLI & Chrome Extension, and many integrations.

Financial Supporters

A heartfelt thank you to the companies and individuals who help keep Password Pusher running. Their support goes toward hosting, maintenance, support and continued development.

Supporter
SerpApi SerpApi is the world’s leading provider of search data, pioneering APIs that turn search engine results into structured, developer-ready information.
WMACCESS Provides securities information and tax-relevant financial data, including securities master data and income data for comprehensive tax reporting.

A special thank you as well to every customer who subscribed to a plan on pwpush.com or purchased Self-Hosted Pro — your support directly funds the ongoing development of Password Pusher.

Interested in supporting Password Pusher? Reach out at [email protected].

Features

Security & privacy

  • Encrypted at rest — Sensitive data is stored encrypted and deleted when expired.
  • Expiry controls — Limit by number of views and/or time; links can require a passphrase.
  • Two-factor authentication (MFA) — TOTP (authenticator apps) with backup codes; admins can require MFA instance-wide with PWP__REQUIRE_MFA=true.
  • Audit logging — Track what was shared and who viewed it (with optional logins).
  • Unbranded delivery page — No logos, superfluous text or unrelated links to confuse push recipients.

Self-host & customize

  • One-command deploy — Docker Compose with automatic SSL/TLS
  • Database or ephemeral — Use a database for persistence or run stateless.
  • Admin dashboard — Manage your instance from a built-in admin UI.
  • White-label — Custom theme, logo, site name, and 26 Bootswatch themes via env vars.
  • Custom CSS — Add your own styles; light/dark follows system preference.

Integrations & API

  • JSON API v2 — Modern /api/v2 endpoints for create/retrieve/audit/active/expired workflows.
  • Legacy API compatibility — Existing /p, /f, /r API routes (v1 style) remain available for backwards compatibility.
  • CLI — Official pwpush CLI plus 3rd-party tools and scripts.
  • 31 languages — UI and secret-URL pages in 31 languages (courtesy of Translation.io).

Trust & community

  • Open source — Apache 2.0; no black box. Written and maintained by myself and the team at Apnotic with the help of contributors.
  • 15+ years in production — Used to deliver millions of secrets; actively maintained.
  • Trusted worldwide — Used by thousands of companies around the globe.

Screenshots

Front page Audit log Languages
Create a push Audit log Multi-language URLs
Password generator Dark theme Preliminary step
Password generator Dark theme Optional preview step

Editions

Open source (this repo) Pro (pwpush.com)
Try it oss.pwpush.com pwpush.com
Use case Self-host or use OSS demo Hosted Pro with extra features
Details Full source here; you deploy or use the OSS demo. Pro features are periodically migrated to OSS.

Feature comparison: pwpush.com/features#matrix

Self-Hosted Password Pusher Pro

Self-hosted Pro (with licensing) is now available. Pro features not yet in OSS will be available for self-hosted deployments.

Quick Start

Use the hosted service

No setup: pwpush.com — create a push and share the link.

Run your own instance with Docker Compose

  1. Point a DNS record to your server (e.g. pwpush.example.com).
  2. Clone this repo or download docker-compose.yml.
  3. In docker-compose.yml, uncomment and set:
    • TLS_DOMAIN: 'pwpush.example.com' (for automatic Let’s Encrypt TLS).
    • Optionally set PWPUSH_MASTER_KEY (see comments in the file; generate at us.pwpush.com/generate_key).
  4. Run:
docker compose up -d

Open https://pwpush.example.com. The Compose file includes persistent storage, health checks, and is suitable for production.

Note: If you didn't set TLS_DOMAIN, uncomment port 5100 and visit the application on http://your-ip:5100

Cloud deploy & contributor setup

The repo includes ready-to-adapt configs for common platforms and local dev:

File / path Use
app.json Heroku-style deploy (env vars, postdeploy / db:prepare, process types).
.do/deploy.template.yaml DigitalOcean App Platform spec (web + job, secrets placeholders).
render.yaml Render Blueprint (web + Postgres, health /up; optional worker commented).
fly.toml Fly.io (fly launch — set app name; Dockerfile containers/docker/Dockerfile).
railway.toml Railway config-as-code (Dockerfile path; set secrets in dashboard).
.devcontainer/ VS Code / GitHub Codespaces: Ruby + Postgres, repo mounted at /workspace, bin/setup.

Production image build: containers/docker/Dockerfile. Root docker-compose.yml uses the published image; .devcontainer/docker-compose.yml is for development with a mounted working tree.

Use the API, CLI, or integrations

For API usage, CLI tools, and integrations:

Quick API v2 smoke test:

curl -s https://YOUR_HOST/api/v2/version

Tools & Extensions

Enhance Password Pusher with these official companion tools:

CLI Chrome Extension
pwpush CLI Chrome Extension
Command-line tool for pushing secrets from the terminal Create pushes directly from your browser with self-hosted & APIv2 support

Documentation

Full docs: docs.pwpush.com — installation, configuration, API, themes, and more.

Language translations

Translation.io has provided free translation tooling for the OSS version of Password Pusher. The app ships with 31 UI languages.

Translation.io

Consider Translation.io for your company or project’s translation needs.

Credits

Security researchers

Translators

Name Language
Oyale Catalan, Spanish
Finn Skaaning Danish
Mihail Tchetchelnitski Finnish
Thibaut French
Thomas Wölk German — GitHub, Twitter
Martin Otto German
Robin Jørgensen Norwegian
Łukasz Polish
Jair Henrique, Fabrício Rodrigues, Ivan Freitas, Sara Faria Portuguese (BR)
Pedro Marques European Portuguese
johan323, Fredrik Arvas Swedish

Thanks also to Translation.io for managing translations (free for open source).

Containers & infrastructure

Other

More: Contributors

Stay updated

Donations

🛑 Because of some abuse, the donation link is temporarily disabled. Contact [email protected] if you'd like to donate

--> To those testing various cards and failing, do what you do but please not here. We can't risk getting the account flagged in Stripe - we're not big enough to deal with that type of damage. I hope you can understand our position.

Donations are optional. Password Pusher is and will remain open source and free to use.

If it’s useful to you and you’d like to support development, donations are greatly appreciated and go toward hosting, maintenance, testing, and new features.

Donate QR Donate via Stripe

You can also support the project with a paid plan on pwpush.com.

Note: Password Pusher is operated by Apnotic, LLC. Donations support the project but are not tax-deductible charitable contributions. See FAQ for more on Apnotic and trust & security.

Star history

Star History Chart

License

This project is licensed under the Apache License 2.0. See LICENSE for details.

Citation

@misc{PasswordPusher,
  author = {Peter Giacomo Lombardo},
  title = {Password Pusher: Securely share sensitive information with automatic expiration and deletion. Track who, what and when with full audit logs.},
  year = {2026},
  publisher = {GitHub},
  howpublished = {\url{https://github.com/pglombardo/PasswordPusher}}
}

Frequently asked questions

Is PasswordPusher free to use?

PasswordPusher is open source under the Apache-2.0 licence. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does PasswordPusher do?

🔐 Securely share sensitive information with automatic expiration & deletion after a set number of views or duration. Track who, what and when with full audi

What is PasswordPusher written in?

PasswordPusher is primarily written in Ruby. Its source is publicly available at https://github.com/pglombardo/PasswordPusher, and it has 3,202 GitHub stars.