Password Pusher (PwPush) is a well-respected open-source tool for sharing passwords through expiring links. It has been a staple in the sysadmin community for years, and for good reason: it is simple, self-hostable, and actively maintained.
However, the default PwPush configuration relies on server-side encryption. This means that unless you customize the deployment with your own encryption keys and lock down the infrastructure, the server technically has access to the plaintext data at some point during the process. For teams operating under a Zero Trust security model, this default behavior is a concern.
Nurbak takes a different approach. Encryption happens entirely in the browser using AES-256 before any data reaches the server. The decryption key lives only in the URL fragment and is never transmitted. This is client-side encryption by default, with no configuration required.