Password Pusher alternative: zero-knowledge comparison

The short answer

What actually differs

In short: Password Pusher has been established for years and brings file sharing, an audit log for every push and a choice between an EU and a US instance. Erseni Vault differs on one point that may count for you: encryption happens in the browser, so the server sees the plaintext neither when you send nor when you request.

Point by point

Every line states what each tool does, not just a tick or a cross. Where we are behind, it says so.

Criterion

Password Pusher

Erseni Vault

Encryption in the browser (zero knowledge)

Password Pusher Server-side Password Pusher encrypts the content with AES-256-GCM on the server. The operator holds the key and could technically read the content.

Erseni Vault Yes AES-GCM-256 in the browser. The key lives in the URL fragment after the #, which browsers never send to a server, so Erseni only ever holds ciphertext. A note you add to a secret in the dashboard is stored in plain text instead; it labels the secret, it does not contain it.

Requesting credentials

Password Pusher Yes, with a server-held key, on paid plans With Requests you send someone a link through which they upload something to you. In the hosted offering this belongs to the paid plans, and the answer is encrypted with the same server-held key as the sending path.

Erseni Vault Yes, end-to-end You create a request link for one specific person. Their browser generates a key pair locally (X25519) and encrypts the answer to it, so only you can read what they submit. They need no account and no software.

Secrets for AI agents

Password Pusher An API and a CLI for sending Password Pusher has a JSON API and a command-line tool with which a program creates pushes. Binding the value to a command and masking the output are not part of it.

Erseni Vault vault-ask and an MCP server An agent requests the value through a link, you enter it in your browser and see the command that will receive it. vault-ask passes it to exactly that command and masks it in its output; it never appears in the chat or the session log.

Account required to send

Password Pusher No The free tier works without signing up. Team features and your own branding need an account.

Erseni Vault Neither for sending nor for requesting Sending and requesting both work without signing up. A free account only adds the dashboard showing the status of your secrets.

Expiry and self-destruction

Password Pusher After views or days A push expires after a configurable number of views, after a period of time, or whichever comes first.

Erseni Vault Yes, on first retrieval The first retrieval deletes the record in the same database operation that reads it, so a second attempt finds nothing.

Files

Password Pusher Yes, on paid plans File pushes are available in the hosted offering from the smallest paid plan upwards.

Erseni Vault Limited Attachments are part of the Business tier, one file of up to 10 MB per secret.

Audit log

Password Pusher On every plan Every push and every request is logged with when it was created, viewed and deleted.

Erseni Vault On the Business plan The Business plan's audit log shows who retrieved which secret and when, with export.

Open source and self-hostable

Password Pusher Yes, Apache-2.0 The open-source edition is published under Apache-2.0 on GitHub and runs as a Docker container. A paid Pro edition for self-hosting exists alongside it.

Erseni Vault Yes The cryptography component is published under the AGPL in a public mirror and can be self-hosted.

Maturity and adoption

Password Pusher In use for many years The project has been actively maintained for a long time and, by its own account, has delivered millions of secrets.

Erseni Vault Launched 2026, small project Erseni Vault is young, the user base is small and an external cryptography audit is still outstanding. If you need maximum operational maturity, factor that in.

Hosting location

Password Pusher EU or US instance The hosted offering comes as an EU and a US instance, and you choose. If your compliance depends on it, check the operator's current statements.

Erseni Vault Germany (Hetzner, Falkenstein) Servers and backups stay inside the European Union. The processors are listed individually at /subprocessors.

Where Password Pusher is the better choice

Be honest about the fit

You want to share files rather than short credentials. Password Pusher is built for that.

You need an audit log for every single push, without a Business plan.

You want a service with a long operating history and a large user base.

Server-side encryption is enough for you, and you want to choose between an EU and a US instance.

The difference when requesting: who holds the key

Requesting instead of sending

Both services cover the reverse direction: you need a login from someone else and send them a link instead of waiting for an email. With Password Pusher the answer is encrypted on the server, with a key the operator holds. With Erseni Vault the person's browser generates a key pair locally, encrypts what they type against it and sends us only ciphertext; you alone can decrypt it. In both cases the person needs no account. If it does not matter to you whether the operator could technically read along, switching gains you little here.

Create a request link

How it works

Where these statements come from

Sources and limits of this comparison

We compare against public documentation and source code, and we say when we have not verified something ourselves. Products change: if a detail here matters to your decision, check it at the source before you rely on it.

Password Pusher on GitHub Open-source edition under Apache-2.0, encryption of stored data, expiry by views and time, JSON API.

Password Pusher: comparison with Bitwarden Send The provider's own description of server-side encryption, Requests and files on paid plans, audit log and the EU and US instances.

Password Pusher CLI The command-line tool for the API.