ProtectedShare vs Password Pusher

Password Pusher's security docs say it doesn't provide client-side encryption. Your browser sends the push over HTTPS, and the server encrypts it with AES-GCM, using a key derived from a master key, before storing it. At expiry the encrypted data is deleted. That protects the database at rest, but the readable secret passes through the server on the way in.

Their docs are upfront about it: if you need encryption where only the sender and receiver can decrypt, Password Pusher might not meet that requirement. ProtectedShare is built for that case. Your browser encrypts with AES-256-GCM before upload, the key stays in the link after # or in a password you send separately, and the server stores ciphertext plus the hash of a token it checks before releasing it. The security page spells out every field.

On pwpush.com, file pushes come with the paid plans, and on a self-hosted install they need a signed-in user. Their security docs note that uploaded files aren't encrypted by Password Pusher itself, and recommend an encrypted storage backend such as S3. In return there's no hard limit on file size; their FAQ mentions files up to 4 GB in testing.

ProtectedShare's file drop needs no account and encrypts every file in your browser, in 1 MiB chunks, before upload. File names are encrypted too. The cap is 25 MB per drop.

Password Pusher has accounts. Signed in, you get an audit log for each push showing when it was viewed, with IP addresses and user agents, and paid plans add teams, custom domains and branding. If your helpdesk needs a shared record of who saw which credential, that's a real reason to choose it.

ProtectedShare has no accounts. The browser that made a link keeps it in My links, where you can see whether it was opened and revoke it. The server keeps a receipt with counts and times, never content.