Password Pusher alternative: OncePad vs Password Pusher
Both hand over credentials with an expiring link. The difference is who holds the encryption key.
Short answer: OncePad is a free, no-account service for sharing a password, secret, or file through an end-to-end encrypted link. The link contains no decryption key, works once, and expires after 24 hours. Files may be up to 25 MB.
Where they agree
Password Pusher (pwpush) is a well-established tool for sending passwords, text, files and URLs through links that expire after a number of views or days, with optional passphrases and audit logs. It is popular with IT teams for good reason. OncePad covers the same core act — hand a secret to someone through a link — with a narrower, end-to-end model.
The core difference: server-side vs in-browser encryption
Password Pusher's documentation describes server-side encryption: sensitive database fields are encrypted at rest with AES-256-GCM using keys derived from a server master key, and the product explicitly says it does not provide custom client-side encryption. That can be a sound design for a tool your team operates, but the operator holds the master key. OncePad never has a decryption key: the secret is encrypted in your browser under a generated 7-word passphrase, and the passphrase travels on a second channel.
Side by side
| Feature | OncePad | Password Pusher |
|---|---|---|
| Encryption location | Browser, before upload (end-to-end) | Server-side; AES-256-GCM for sensitive database fields |
| Key placement | Derived from a generated passphrase sent separately; no key in link | Server master key; optional pre-shared passphrase |
| File support / limit | One browser-encrypted file up to 25 MB | Files available by edition/configuration; no universal size limit |
| Expiry | Exactly one reveal or 24 hours | Configurable time and view count |
| Accounts | No account | Anonymous, account, hosted, and self-hosted options vary by edition |
| Open-source status | Hosted app source not publicly released | Apache-2.0 open-source edition; hosted and Pro editions add features |
When Password Pusher may suit you better
If you need multiple views, longer expiries, URL pushes, detailed audit logs, accounts, team administration, or a self-hosted instance, Password Pusher is built for that operational model. Its hosted and self-hosted editions also offer file workflows that are broader than OncePad's one-file handoff.
When OncePad is the better fit
If the requirement is that nobody but the recipient can ever decrypt it — not the service, not an admin, not someone who later obtains the database — and you want a strong passphrase by default and a link that is safe to leave in a ticket, OncePad's end-to-end, one-read, RAM-only design is the simpler answer.
Last verified: August 18, 2026. Descriptions of Password Pusher are based on its primary documentation and are given in good faith; editions, limits, and policies change, so verify them before deciding. Password Pusher is a trademark of its respective owner and is not affiliated with OncePad.