Every small business has a moment when someone on the team needs to hand another person a password. A vendor login for your bookkeeper. Temporary credentials for a contractor. The admin password your IT helper needs to finish a fix. Too often, that password travels by email, text message, or a group chat — which means it now lives in inboxes and chat history indefinitely, copied across every device you and the recipient own. Password Pusher solves this with a better delivery method: share secrets through links that expire on their own, instead of email or chat.
What Password Pusher Actually Does
Password Pusher is an open-source tool for sharing secrets — passwords, sensitive text, URLs, and one-time file uploads — through temporary links. You paste the secret into the tool, set your expiration rules, and it hands you a single link. The person on the other end opens the link once, sees the password, and the secret disappears: the link can be set to expire after a set number of views, a set amount of time, or both. After it burns out, nobody who finds the message later can open it.
This is a fundamentally different delivery model from "send it in an email." With email or chat, a password becomes a permanent copy sitting in message history — searchable, forwardable, and retained on mail servers and devices you don't control. With an expiring push link, the secret has a lifespan you choose, and it destroys itself when that lifespan ends. For small businesses juggling logins between staff, vendors, and outside support, that difference removes one of the most common ways credentials leak.
It also removes an awkward daily annoyance: the "I'll text you the password" moment. Recipients don't need an account. You send them a link, they click, they get the credential. That's the whole experience.
Why SMBs Should Care About How Passwords Travel
Credential sharing is one of those habits that rarely gets a second look until something goes wrong. A few real-world patterns we see constantly:
- Vendor handoffs — You grant a supplier or contractor access to a portal, and that login sits in an email thread they'll keep forever. If their inbox is later compromised, so is your portal account.
- Contractor and IT handoffs — A project ends, but the credentials you exchanged by chat are still live in everyone's history. With an expiring push, the access details vanish when the work wraps up.
- Password rotation — Someone leaves the company and you change shared logins. If those passwords traveled by email, they're still sitting in departed employees' inboxes. Push links self-destruct instead.
- Break-fix support — When your IT provider needs a credential to resolve a problem, a one-time link gets it to them securely without it landing in a ticket system or email archive.
Password Pusher encrypts secrets at rest with AES-GCM encryption, so the secret isn't readable by anyone holding the database — only the link holder gains access, and only while the link is live. On the open-source edition, you also get an admin dashboard and user logins, so you can run it as a managed internal tool rather than a free-for-all page.
Pick the Edition That Matches Your Needs
Password Pusher has been actively maintained since 2011 and is available in several editions. The right choice comes down to one question per the project's own documentation: who operates the servers, and which features you need. You can run it as a hosted service, buy a license to self-host the Pro edition, or deploy the open-source edition yourself.
- Hosted service (pwpush.com) — The simplest path. A free tier covers core pushes with API access, and paid tiers add file sharing, custom branding and domains, team collaboration with role-based access control, webhooks, and SSO. Everything is operated for you, with data regions in the US or EU. Pick this if you want the tool without owning the server.
- Open-source edition (self-hosted) — Free under the Apache 2.0 license, self-hosted only. You get secure text, URL, and QR code pushes, a full JSON API, AES-GCM encryption, admin dashboard and user logins, plus basic rebranding. Deploy it with Docker Compose on hardware you already own. Best for businesses that want the essentials and don't mind maintaining a container.
- Self-hosted Pro edition (paid license) — An enterprise-grade version for organizations that must keep everything on private infrastructure but want the advanced capabilities without running the open-source container themselves. Best for teams with compliance requirements around data residency and access control.
For most of our small-business clients, the decision follows a simple pattern: if you have someone maintaining even a small amount of IT infrastructure already, the open-source edition on a spare Proxmox LXC container or Docker host is essentially free — the only cost is the 10 minutes a month it takes to update the image. If you don't want any servers involved, the hosted service handles it for you.
How Beawit Uses It in Production
We deploy Password Pusher as part of our client security toolkit. When we onboard a new client, credentials for switches, firewalls, and cloud portals are documented once in a password manager — but the first delivery of those credentials happens through expiring push links, not a spreadsheet or an email thread. When a client requests a password during a support call, we generate a one-time link through our internal instance: the credential arrives the same second they need it, and the copy in transit self-destroys after it is read.
Here's what a practical deployment looks like for a typical SMB:
- Run the container — The open-source edition runs comfortably on a small Proxmox LXC container or a Docker Compose stack on hardware you already have. Put it behind a reverse proxy with TLS.
- Set standard expiration defaults — We recommend one-time views for support credentials, and short-lived pushes (valid a day or two) for onboarding packages.
- Document the habit — If your team uses a password manager, the push tool fills the transport gap: the manager stores the credential, the push link delivers it. Make push links the default for anything that leaves the team.
- Rehearse the rotation drill — When you change a shared password, send the new credential as a push link and let the old email copies go stale — then confirm the old links are dead.
Security Practices for Self-Hosting
Self-hosting a secrets tool means holding a small vault, so treat it like one:
- TLS everywhere — Never serve a secrets tool over plain HTTP. Terminate certificates at a reverse proxy (Caddy or Traefik both handle Let's Encrypt automatically).
- Restrict who can reach it — Put the instance behind your VPN or a Cloudflare Tunnel for remote users rather than opening direct ports to the internet.
- Keep data encrypted — The open-source edition supports AES-GCM encryption; enable it, and make sure your database backups are encrypted as well.
- Update the container monthly — A lightweight tool like this is easy to keep current — the same monthly patch pass you run for the rest of your stack covers it.
- Never embed it in email flows — If your staff start pasting push links into recurring email reports, you've recreated the original problem. Push links are for person-to-person delivery.
The takeaway is simple: how a password travels matters just as much as how it is stored. You can have the strongest password manager in the world, and it won't protect you if the password itself reaches its destination through a channel that keeps it forever. Password Pusher closes that gap with links that arrive, deliver, and disappear.
Beawit Consulting provides IT support and services to small and medium businesses in the Vancouver/Portland metro area. We specialize in Microsoft Azure, M365, hybrid cloud, network engineering, and infrastructure automation.
Contact us at contactus@beawit.net or call (360) 853-5338.
Looking for reliable internet connectivity for your business? Use our Scout lookup tool to search available options from over 75 providers, including AT&T, Comcast, Cox, Crown Castle, Fidium, Frontier, Lumen, Spectrum, Verizon, and Zayo — with instant pricing proposals and contracts.
