Password Pusher vs OneTimeSecret

The short answer

• Choose Password Pusher for files, configurable views and expiry, credential requests, and an audit log of who viewed a push.
• Choose OneTimeSecret for strict one-view links, a choice of five data regions, custom domains and a free basic tier.
• Both encrypt on their servers rather than in your browser. If browser-side encryption matters, look at CredenShare.

Who this page is for: teams choosing an open-source secret-sharing tool, hosted or self-hosted.

Password Pusher vs OneTimeSecret at a glance

Checked on October 23, 2026 against each project's own pages. Password Pusher's pricing page shows "$" without a currency code. See the sources below.

Which is more secure?

Both encrypt on their servers. Password Pusher states that browser-side encryption is not provided, and encrypts with AES-GCM 256 using per-field derived keys. OneTimeSecret says secrets are encrypted in transit and at rest on every plan, without naming an algorithm. Both are open source, so you can review the code or run it yourself. Neither names an independent audit.

Which has more features for teams?

Password Pusher: roles, team two-factor enforcement, policies, webhooks (metadata only), an audit log of every view, and OIDC SSO on Organization. OneTimeSecret: up to 50 or 100 members, SSO and roles on Team Plus, and unlimited custom domains on paid plans.

Can either collect a credential?

Password Pusher can: requests let you "securely request credentials from anyone", with a notification when one is submitted. Its CLI marks requests as a Pro feature, so check before relying on them in the open-source edition. OneTimeSecret's incoming secrets are described as a work in progress.

Which should you self-host?

Both run in Docker. Password Pusher has self-hosted Pro editions with more features; OneTimeSecret added SAML SSO for self-hosted installs on October 1, 2026. Self-hosting puts patching, backups and uptime on you.

Which should you pick? Scenarios

What neither Password Pusher nor OneTimeSecret covers

• Encryption in the browser. Both encrypt on their servers, so the service could, in principle, read a secret while it holds it.
• Links that start counting at the first open, for recipients who act days later.
• SDKs and an MCP server for developers and AI agents.

CredenShare is built for work handoffs, in both directions:

• Encryption in your browser (AES-256-GCM) for shares made in the web app, API and SDKs; the key travels after the # in the link. Slack-created shares are encrypted on our servers.
• Access logs for every share: views, times and IP addresses, kept 3 to 180 days by plan.
• Expiry from 1 hour to 3 months, optionally counted from the first open, plus passcodes and view limits.
• Secure Requests (Business and Enterprise): a form with the fields you need, encrypted in the submitter's browser.
• Teams, Slack, a browser extension, a REST API, SDKs and an MCP server for AI agents.

The Free plan covers 3 shares a day. See pricing.

Before you share a credential: a checklist

These apply whichever tool you use.

1. Send the link and the passcode through different channels. For example, the link by email and the passcode by text message.
2. Watch out for link scanners. Some email security filters and chat apps open links automatically, which can use up a one-view link. Send the link as plain text through a channel that doesn't pre-open links, or allow a second view with a short expiry.
3. Don't open the link to test it. On a one-view link, your test is the view.
4. Pick the shortest expiry that works. If you don't know when the recipient will act, a link that starts counting at the first open is safer than a long fixed window.
5. Rotate after the handoff when you can. The link expires, but the credential is still valid.
6. Keep the original in your password manager. A sharing link is a delivery method, not storage.

Verdict: Password Pusher or OneTimeSecret?

• Pick Password Pusher for files, requests and audit logs.
• Pick OneTimeSecret for strict one-view links, data regions and custom domains.
• If browser-side encryption matters, look at CredenShare.

Related: CredenShare vs Password Pusher · CredenShare vs OneTimeSecret · OneTimeSecret vs Privnote

Sources (checked October 23, 2026):

• Password Pusher: pricing, security, encryption, configuration, requests, GitHub
• OneTimeSecret: pricing, docs, data protection, secret links, compare plans, incoming secrets, GitHub

Password Pusher, OneTimeSecret are trademarks of their respective owners. CredenShare is not affiliated with any of them.