Skip to content
Ownership · 7 min read

Self-hosted web push and owning your list

“Own your list” gets said a lot. With web push it has a precise technical meaning. Here’s what it is, what it isn’t, and the honest trade-offs between self-hosting and a hosted service.

Updated By the Pusharoo team
In short
  • A push list is a set of browser endpoints plus the VAPID key pair that created them.
  • Without the private key, an exported list cannot be sent to.
  • True self-hosting means running your own sender and keys — powerful, but you own uptime and security.
  • Pusharoo runs its own push stack on its own server (no reselling, no Firebase), and your sw.js lives on your domain.

What a push list actually is

What owning a push list actually meansA push list is a set of browser endpoints bound to one VAPID key pair. Whoever holds the private key and the endpoint list can send. If either is lost, every subscriber must opt in again.📇Endpoint listone encrypted URL per browser+🔑VAPID key pairpublic key in the browser, private on the server=✅A list you can send tolose either → re-subscribe allWhat owning a push list actually meansA push list is a set of browser endpoints bound to one VAPID key pair. Whoever holds the private key and the endpoint list can send. If either is lost, every subscriber must opt in again.📇Endpoint listone encrypted URL per browser+🔑VAPID key pairpublic in browser · private on server=✅A list you can send tolose either → re-subscribe all
Exporting endpoints without the matching keys is not a portable list.

Every subscriber is an endpoint URL issued by a browser’s push service plus two encryption keys for that browser. Every endpoint is bound to one VAPID public key. Only the holder of the matching private key can send to it.

The portability truth

Some tools let you export subscribers as a CSV. That’s useful for analytics, but unless you also receive the private VAPID key, no other sender can deliver to those endpoints. This is why switching push providers usually means subscribers re-opt in. It’s a property of the standard, not a trick — but it’s worth knowing before you pick a tool.

Your three options

Self-host it yourselfHosted SaaSPusharoo
Who runs the senderYouVendorPusharoo, on its own dedicated server
CostServer + your timeUsually per subscriber$0 for life
SetupDays: library, DB, queue, prompt, cleanupMinutes~5 minutes
Uptime & securityYour jobVendor’s jobPusharoo’s job
Service worker on your domainYesUsuallyYes

Want to build it yourself? Open-source libraries such as minishlink/web-push (PHP) and web-push (Node.js) implement the protocol. You’ll also need a subscriber database, a queue, a soft prompt, frequency caps and 404/410 cleanup — the parts Pusharoo already does.

How Pusharoo keeps you in control

  • sw.js is served from your origin, so the subscription is created on your site.
  • Standard Web Push only — no proprietary app, no Firebase project in the middle.
  • Signed webhooks for every subscribe, unsubscribe and click, so your own systems keep a record.
  • Minimal data: endpoint, browser type, language and timezone. No names, emails or cookies (see privacy).
  • No “Powered by” badge — visitors only ever see your brand.

Questions

Can I export my push subscribers and use them elsewhere?

Only if you also have the private VAPID key that created them. Without it, other services cannot deliver to those endpoints.

Is Pusharoo self-hosted?

Pusharoo is a hosted service that runs its own push stack on its own dedicated server using open standards. You don’t have to run anything except the sw.js file on your site.

What happens if I stop using Pusharoo?

Remove the snippet and sw.js (see the uninstall steps in the docs). Visitors stop receiving notifications from your site.

More in Choosing a tool: Choosing a push notification service for your website · The best free web push notification services, compared · Looking for a PushEngage alternative? · Looking for a Webpushr alternative? · Looking for a PushOwl alternative? · All guides

Free for life. No limits.

Unlimited subscribers, campaigns and automations. No badges. About five minutes to install.