Simple & Secure Password Sharing with Auto-Expiration of Shared Items
Give your users the tools to be secure by default.
Password Pusher is an open source application to communicate passwords over the web. Links to passwords expire after a certain number of views and/or time has passed.
Hosted at pwpush.com but you can also easily run your own private instance with just a few steps.
- Easy-to-install: Host your own via Docker, a cloud service or just use pwpush.com
- Open Source: No blackbox code. Only trusted, tested and reviewed open source code.
- Versatile: Push passwords, text, files or URLs that auto-expire and self delete.
- Audit logging: Track and control what you've shared and see who has viewed it.
- Encrypted storage: All sensitive data is stored encrypted and deleted entirely once expired.
- Host your own: Database backed or ephemeral, easily run your own instance isolated from the world.
- JSON API: Raw JSON API available for 3rd party tools or command line via
curlorwget. - Command line interface: Automate your password distribution with CLI tools or custom scripts.
- Logins: Invite your colleagues and track what is pushed and who retrieved it.
- Admin Dashboard: Manage your self-hosted instance with a built in admin dashboard.
- Internationalized: 29 language translations are bundled in. Easily selectable via UI or URL
- Themes: 26 themes bundled in courtesy of Bootswatch. Select with a simple environment variable.
- Unbranded delivery page: No logos, superfluous text or unrelated links to confuse end users.
- Customizable: Change text and default options via environment variables.
- Light & dark themes: Via CSS @media integration, the default site theme follows your local preferences.
- Re-Brandable: Customize the site name, tagline and logo to fit your environment.
- Custom CSS: Bundle in your own custom CSS to add your own design.
- 10 Years Old: Password Pusher has securely delivered millions and millions of passwords in its 10 year history.
- Actively Maintained: I happily work for the good karma of the great IT/Security community.
- Honest Software: Open source written and maintained by me with the help of some great contributors. No organizations, corporations or evil agendas.
๐ --> Sign up for the newsletter to get updates on big releases, security issues, new features, integrations, tips and more.
Password Pusher is also on Twitter, Gettr and on Facebook
โ Go to pwpush.com and try it out.
or
โ Run your own instance with one command: docker run -d -p "5100:5100" pglombardo/pwpush:latest then go to http://localhost:5100
or
โ Use one of the 3rd party tools that interface with Password Pusher.
๐ ๐ ๐
We've recently introduced a single universal container. Migration for existing users is easy - please refer to the documentation here.
๐ ๐ ๐
Note: Password Pusher can be largely configured by environment variables so after you pick your deployment method below, make sure to read the configuration page. Take particular attention in setting your own custom encryption key which isn't required but provides the best security for your instance.
Docker images of Password Pusher are available on Docker hub.
โ ephemeral Temporary database that is wiped on container restart.
docker run -d -p "5100:5100" pglombardo/pwpush:latest
โ using an External Postgres Database Postgres database backed instance.
docker run -d -p "5100:5100" pglombardo/pwpush:latest -e DATABASE_URL=postgres://pwpush_user:pwpush_passwd@postgres:5432/pwpush_db
โ using an External MariaDB (MySQL) Database Mariadb database backed instance.
docker run -d -p "5100:5100" pglombardo/pwpush:latest -e DATABASE_URL=mysql2://pwpush_user:pwpush_passwd@mysql:3306/pwpush_db
Note: Putting passwords in a command line is bad practice. See the related Database pages for alternative options.
See Also: Guide to DATABASE_URL
| Tag | Purpose |
|---|---|
vX.X.X |
Versioned tags |
stable |
The most stable tag for proven releases |
latest |
The latest (most recent) released vX.X.X |
nightly |
The nightly development build |
If in doubt, use latest or the stable tag.
The previously used release tag is no longer used and won't be updated again. Instead use the stable tag.
โ One-liner Password Pusher with a Postgres Database
curl -s -o docker-compose.yml https://raw.githubusercontent.com/pglombardo/PasswordPusher/master/containers/docker/docker-compose-postgres.yml && docker compose up -d
โ One-liner Password Pusher with a MariaDB (MySQL) Database
curl -s -o docker-compose.yml https://raw.githubusercontent.com/pglombardo/PasswordPusher/master/containers/docker/docker-compose-mariadb.yml && docker compose up -d
Instructions and explanation of a Kubernetes setup can be found here.
A basic helm chart with instructions can be found here.
There used to be a 3rd party blog post with instructions but it's been deleted. If anyone has instructions they would like to contribute, it would be greatly appreciated.
See issue #277
One click deploy to Heroku Cloud without having to set up servers.
This option will deploy a production Password Pusher instance backed by a postgres database to Heroku. Heroku used to offer free dynos but that is no longer the case from November 28, 2022. Hosting charges will be incurred.
One click deploy to PikaPods from $1/month. Start free with $5 welcome credit.
See the prebuilt Docker Compose example here.
I generally don't suggest building this application from source code for casual use. The is due to the complexities in the tool set across platforms. Running from source code is best when you plan to develop the application.
For quick and easy, use the Docker containers instead.
But if you're resolute & brave, continue on!
- Ruby 3.0 or greater
- Recent Node.js stable & Yarn
- Compiler tools: gcc g++ make
- Other: git
- Make sure to install sqlite3 development libraries:
apt install libsqlite3-dev sqlite3
git clone [email protected]:pglombardo/PasswordPusher.git
cd PasswordPusher
gem install bundler
bundle config set --local deployment 'true'
bundle install --without development production test
./bin/rails assets:precompile
./bin/rails db:setup
./bin/rails serverThen view the site @ http://localhost:5100/.
- Make sure to install related database driver development libraries: e.g. postgres-dev or libmariadb-dev
git clone [email protected]:pglombardo/PasswordPusher.git
cd PasswordPusher
gem install bundler
export RAILS_ENV=production
# Update the following line to point to your Postgres (or MySQL/Mariadb) instance
DATABASE_URL=postgresql://passwordpusher_user:passwordpusher_passwd@postgres:5432/passwordpusher_db
bundle install --without development test
./bin/rails assets:precompile
./bin/rails db:setup
./bin/rails server --environment=productionThen view the site @ http://localhost:5100/.
-
The almost official pwpush-cli (in pre-beta): CLI for Password Pusher with authentication support
-
thekamilpro/kppwpush: A PowerShell Module available in the PowerShell Gallery. See the livestream of its creation on The Kamil Pro's channel.
-
pgarm/pwposh: a PowerShell module available in the PowerShell Gallery
-
lnfnunes/pwpush-cli: a Node.js based CLI
-
abkierstein/pwpush: a Python based CLI
- Tachaeon/PWPush-Generator: A powershell GUI frontend for pwpush.com
- oyale/PwPush-PHP: a PHP library wrapper to easily push passwords to any Password Pusher instance
See also the Tools Page on pwpush.com.
Password Pusher is currently available in 29 languages with more languages being added often as volunteers apply.
From within the application, the language is selectable from a language menu. Out of the box and before any language menu selection is done, the default language for the application is English.
The default language can be changed by setting an environment variable with the appropriate language code:
PWP__DEFAULT_LOCALE=es
For more details, a list of supported language codes and further explanation, see the bottom of this configuration file.
pwpush.com is hosted on Digital Ocean and is happily paid out of pocket by myself for more than 10 years.
But you could help out greatly by signing up to Digital Ocean with this link (and get $200 credit). In return, Password Pusher gets a helpful hosting credit.
tldr; Sign up to Digital Ocean with this link, get a $200 credit for free and help Password Pusher out.
Thanks to our great translators!
If you would like to volunteer and assist in translating, see this page.
| Name | Language | |
|---|---|---|
| Oyale | Catalan | |
| Finn Skaaning | Danish | |
| Mihail Tchetchelnitski | Finnish | |
| Thibaut | French | |
| Thomas Wรถlk | German | Github, Twitter |
| Martin Otto | German | |
| Robin Jรธrgensen | Norwegian | |
| ลukasz | Polish | |
| Jair Henrique | Portuguese | |
| Fabrรญcio Rodrigues | Portuguese | |
| Ivan Freitas | Portuguese | |
| Sara Faria | Portuguese | |
| Oyale | Spanish | |
| johan323 | Swedish | |
| Fredrik Arvas | Swedish | |
| Pedro Marques | European Portuguese |
Also thanks to translation.io for their great service in managing translations. It's also generously free for open source projects.
Thanks to:
-
@fiskhest the Kubernetes installation instructions and manifests.
-
@sfarosu for contributing the Docker, Kubernetes & OpenShift container support.
-
sirux88 for cleaning up the Docker files and adding multistage builds.
Thanks to:
-
@iandunn for better password form security.
-
Kasper 'kapรถw' Grubbe for the JSON POST fix.
-
JarvisAndPi for the favicon design
...and many more. See the Contributors page for more details.
This project is licensed under the terms of the Apache License 2.0 license. See LICENSE for more details.
@misc{PasswordPusher,
author = {Peter Giacomo Lombardo},
title = {An application to securely communicate passwords over the web. Passwords automatically expire after a certain number of views and/or time has passed.},
year = {2024},
publisher = {GitHub},
journal = {GitHub repository},
howpublished = {\url{https://github.com/pglombardo/PasswordPusher}}
}
![dependabot[bot] avatar](https://avatars.githubusercontent.com/in/29110?v=4 "dependabot[bot]")
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent