SecretBolt vs Password Pusher

Pick SecretBolt if you mostly hand secrets to teammates, pipelines and clients from a terminal: one curl call creates a one-time link, and the recipient's side can load a .env straight into the shell. Pick Password Pusher if you need to run it on your own servers, want white-label branding for your clients, or are an MSP looking for a partner program — SecretBolt has none of those.

Side by side

	SecretBolt	Password Pusher
Price	Free: $0, no card required. Pro $9/mo waitlist, Team $29/mo waitlist — not purchasable yet.	Free tier. Hosted paid plans: Solo $19/mo, Team $29/mo (3 users), Organization $49/mo (5 users). Self-hosted Pro from $59/mo.
API	REST API on every plan, with read-write or read-only keys.	JSON API and a CLI, on every plan including Free.
Export to environment variables	Yes. `GET …/export` prints shell-safe `KEY='value'` lines to save to a file, read and load, or to pass to `eval`.	Not listed.
Passphrase on a secret	Yes, optional, on every plan (stored as a bcrypt hash).	Yes, passphrase-protected links on every plan.
View and expiry limits	Free: up to 2 views and 24h per secret, 10 active secrets. Pro: 10 views, 7 days waitlist; Team: 50 views, 30 days waitlist.	Yes, view and time limits on every plan.
Event log	Yes, on every plan: each secret's created, viewed, expired and destroyed events, with IP and User-Agent for views.	Yes, detailed audit logs on every plan.
Self-hosting	No — hosted only.	Yes: Docker or Kubernetes (Helm), air-gapped networks supported.
Open source	No.	Yes. The security-critical core is open source (Apache 2.0); team and branding features are closed source.
White-label and MSP program	No.	White-label branding on paid plans; MSP partner program with 30–50% off self-hosted Pro licenses.
Teams	One user per account today. Team management, Advanced audit logs, and Webhook notifications: coming soon on Team waitlist.	Team plan and up: team collaboration, role-based access control, 2FA enforcement.

“Not listed” means we did not find it on the Password Pusher pages linked at the bottom of this page, not that it cannot be done.

Where SecretBolt is the shorter path

Send a `.env` to a teammate

One request from the directory you are in. Allow one view, share the link in chat and the passphrase over a different channel.

Don't type the passphrase into the command itself: shells save commands in history. read -rs PASSPHRASE asks for it without showing it and keeps it out of history.

read -rs PASSPHRASE   # typed, not echoed, not saved in shell history
curl -fsS -X POST https://secretbolt.io/api/v1/secrets \
  -H "Authorization: Bearer $KEY" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --rawfile env .env --arg passphrase "$PASSPHRASE" '{
    name: "staging .env", content: $env,
    max_views: 1, expires_in_hours: 24,
    passphrase: $passphrase}')"
# → {"url": ".../s/…", ...}

Hand a secret to CI/CD

A build step with a read-only key saves the values to a private file and loads them into its environment. Each fetch uses up a view, so this suits one-off handoffs such as bootstrapping a new environment, not values a pipeline reads on every run. In a pipeline, drop the cat line: it prints the values into the build log.

# Recommended: write to a private file, read it, then load it
(umask 077 && curl -fsS -o .env.secretbolt \
  -H "Authorization: Bearer $READ_ONLY_KEY" \
  https://secretbolt.io/api/v1/secrets/$TOKEN/export \
  -H "X-Passphrase: $PASSPHRASE")   # leave $PASSPHRASE empty if the secret has none
cat .env.secretbolt          # check what you're about to load
set -a; . ./.env.secretbolt; set +a
rm .env.secretbolt

Shortcut: `eval`

The output is escaped and PATH or LD_PRELOAD are never exported, but eval means trusting every server response without looking at it.

secret_env=$(curl -fsS \
  -H "Authorization: Bearer $READ_ONLY_KEY" \
  https://secretbolt.io/api/v1/secrets/$TOKEN/export \
  -H "X-Passphrase: $PASSPHRASE") &&   # leave $PASSPHRASE empty if the secret has none
  eval "$secret_env"

Send a password to a client

Your client needs no account, only the link. An unopened link expires on its own, and the passphrase you tell them on the phone never travels with it.

read -rs CLIENT_PASSWORD   # the client's password, kept out of shell history too
curl -fsS -X POST https://secretbolt.io/api/v1/secrets \
  -H "Authorization: Bearer $KEY" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --arg content "$CLIENT_PASSWORD" --arg passphrase "$PASSPHRASE" '{
    name: "Acme admin login",
    content: $content,
    passphrase: $passphrase,
    max_views: 1, expires_in_hours: 24}')"

Full request and response formats are in the API docs.

Try it on your next handoff

The Free plan has the API, export, passphrases and the event log. Pro and Team are not on sale yet — join the waitlist and we will email you when they open.

Get started free Join the Pro / Team waitlist

Competitor details checked on October 13, 2026. Sources: