8 ms·

pass – the standard Unix password manager

168 points by pmoriarty 4y ago

xnacly 4y ago
The only issue i found myself having using stuff like this is syncing to my mobile phone. Currently i am very satisfied with bitwarden due to their firefox extension and mobile ios app which integrates with the ios keychain. Pass sadly isnt usable for me.
- 0xphk 4y ago
  You can use the integrated git feature to sync passwords between all sorts of devices. The nice thing is, that there are pass clients for almost every system including iOS, Android and Windows and with git you simply pull changes in. And by using your own server, you don't have to rely on the security of others to keep your secrets safe.
- treffer 4y ago
  I am using pass on my Android phone all the time (e.g. to log in to ycombibator right now). I use OpenKeychain (from f-droid) to access my yubikey + Password Store (also in f-droid) for git clone (readonly ssh key) and password filling. It integrates with any input field on the whole system and my phone can't decrypt any passwords alone and it uses standard encryption methods.
  - urxvtcd 4y ago
    I think the GP is aware of that, and just decided it's too much of a hassle. I used pass for few years, and have recently switched to bitwarden. I know my way around git well, but I just never remembered to push the new passwords from either my desktop or my phone, which sometimes made me reset the password on one of the devices, and getting conflicts later on, I was always forgetting the password to the SSH key on my phone, and was ever-worried that I don't understand shit about GPG. Two years ago I switched my laptops, and moving the password store to the new one was painful. I'm sure I did something wrong, and that someone who knows what they're doing would have no trouble doing that, but I guess it's not for me. Also, a minor pain point is that generating a new password for an existing login overwrites the whole file, and not only the first line, so I had to copy the other login data from the old file to the new one. I'm sure there's a way around that, but I never bothered.
    - tdido 4y ago
      You can use "-i" for in-place password generation, which will just replace the first line.
- j7ake 4y ago
  Pass syncs on my iPhone using the pass iOS app.
  - captn3m0 4y ago
    Which is adding support for Yubikeys soon.
    - sam_lowry_ 4y ago
      You can use `pass` with Yubikeys, I had this set up for many years
      - captn3m0 4y ago
        The iOS app doesn’t support it yet (the version on the AppStore ie, TestFlight version has had it for a few months - only GPG, not SSH).
- stuzenz 4y ago
  I have done syncing with pass between multiple clients (and android) using syncthing or git. Either option has worked fine. For some reason I prefer syncthing. The android client works perfectly well.
- chriswarbo 4y ago
  I use pass on my PinePhone, and sync using git.
- Kwpolska 4y ago
  I switched from pass to KeePassXC/Keepass2Android (with my .kdbx file living in OneDrive). It’s a much more convenient experience on all platforms. Transparent sync via OneDrive, simple self-contained files and apps, no git and no PGP to mess around with, convenient browser integrations, support for auto-type including working with the the idiotic partial-password thing one of my banks does. pass might be fine if you’re only working with Linux/macOS boxes (although I’d still consider it easy to mess up). If you’re also using Windows, then pass is much less convenient. On Android, the setup with Android-Password-Store and OpenKeychain was pretty fragile and annoying last time I used it.
usr1106 4y ago
Based on git and gpg. So a *ix programmer has full control and full history. And you can move git bundles to offline systems. We used it also as a poor man's vault in a small company, you can have different keys in different directories, not giving everybody access to everything.
- sam_lowry_ 4y ago
  check gopass, it had some team features built-in while maintaining 100% compatibility with pass
- otabdeveloper4 4y ago
  It's a nightmare of mish-mashed ill-matching technologies. Glad I managed to escape my passwords and can now store them in a plain text file.
gnull 4y ago
https://rot256.dev/post/pass/ https://rot256.dev/post/pass/ Make sure you understand how exactly it encrypts your data, and what are the things that are still exposed by it.
- encryptluks2 4y ago
  I give this article a chance, but some assumptions are outright false. For example: > No Post-Quantum security Yeah, no. The beauty of PGP is being able to select your encryption algorithm. Somehow, arguing that AES-256 is more resistant to for example Ed25519 is just factually incorrect and people that use KeePass are not memorizing 40 character passwords to unlock their password manager. > No Service Privacy / Leaks Changes Pass doesn't make assumptions. If you want to encrypt filenames then wrap it with gocryptfs or cryfs or pass-tomb. The nice thing about syncing with pass is having auditable changes that doesn't require a complete database resync. Imagine someone modifying your password store with KeePass. You are not going to have diff to tell what has been changed. With Password Store, you can see exactly what has been changed between syncs. > No authentication of values Again, something that you can change in your PGP settings. I'm not going through the full article, but in all honesty it just sounds like this person doesn't like GnuPG and doesn't understand it. Lest not forget that pass is by the same individual that created wireguard and a slew of other security-focused tools and I think their reputation speaks for itself.
  - culpable_pickle 4y ago
    > people that use KeePass are not memorizing 40 character passwords to unlock their password manager. I use a pass phrase that is substantially longer then 40 characters. It doesn’t take too long to sink in.
    - encryptluks2 4y ago
      Fair, but I think that is more of an exception than the norm. For people that may want to more frequently lock their password database, having a 40 character password would quickly become a PITA.
gnull 4y ago
Can pass be unlocked using login password without entering it once more? For example, like Gnome Keyring does.
- encryptluks2 4y ago
  I believe gpg-agent can connect to Gnome Keyring/Seahorse, but it is usually good to have a reasonable expiration.
- gwd 4y ago
  AFAICT pass just calls out to gpg; so the answer to your question is, "It does whatever a bare gpg command would do". If you have gpg (or more specifically, gpg-agent) configured to ask for a password every time, using pass will require you to enter in your password every time; if you have gpg-agent configured not to ask within an hour of the previous password, using pass will cause you not to have to enter the password more than once an hour. And of course, if you've just entered your gpg password to decrypt an email with GPGMail (Mac Mail PGP plug-in), you won't have to enter your password to decrypt a password, since they're both using gpg behind the scenes.
jbverschoor 4y ago
What does "the standard" mean?
- andrewshadura 4y ago
  Nothing. Just marketing.
- andreareina 4y ago
  Presumably a play on “Ed is the standard text editor.” https://www.gnu.org/fun/jokes/ed-msg.html https://www.gnu.org/fun/jokes/ed-msg.html
  - guerrilla 4y ago
    Oh man, I unironically love ed. That was such a clever thing at the time. It's really nice to understand it too, to put the rest in its historical context.
mike_hock 4y ago
It doesn't (and can't) really address the most important issue that there's no secure clipboard and on top of that some desktop environments come with "clipboard history" malware by default that sniffs your clipboard and logs its content to an unencrypted file.
- gspr 4y ago
  The threat model assumes at least some trust in the system you're running pass on.
- weberer 4y ago
  Oh boy, wait until you find out how X11 handles keyboard input.
- tialaramex 4y ago
  You needn't use the clipboard feature, and in fact I think I can count how often I've used it on my fingers after several years. My browser has a pass-compatible agent that requests passwords for web sites when I tell it to do that, if I just want to know an actual human password that's in pass, I run it on the command line and look at my terminal. In my home the visual displays are not recorded ("for training and quality purposes").
- 0daystock 4y ago
  Someone who can sniff your clipboard doesn't need your passwords, they can just lift your cookies or files directly.
yonrg 4y ago
Imho, plain text is the optimal way to store passwords and related meta data. Before pass became popular I started with my own 'plain text pw store', while converting from some db backed $PWSTORE, which became obsolete. So now I'm happy to have it all in a single text file with some markup around. Editing is done with some vim settings like folding, not showing passwords and pushing entries to the clipboard. And here lies the difference. What I was not able to do this with pass: I think I use xclip, which detects if the clipboard was used, after which the pw is removed from the clipboard. No timeout. This enabled me to consecutively send a list of strings to the clipboard. E.g 1. Send URL, 2. Username, 3. Secret. Recently, I added TOTP support. I think pass is not able to do this. I would like to convert over to pass, but my established workflow is to convenient. Well, I haven't checked all the extensions of pass though. Otoh, I would not like to write an extension of my own. Perhaps, pass supports similar functionality now?
- endre 4y ago
  It would be really easy to implement this, as a wrapper around pass.
- mariusor 4y ago
  I'm using gopass, which is a mostly API compatible alternative to pass written in go. It definitely has support for xclip/wl-clip.
  - andrewstuart2 4y ago
    I'm now using gopass as well, and it's great! Especially with https://github.com/gopasspw/gopassbridge https://github.com/gopasspw/gopassbridge, I get browser auto complete. And https://play.google.com/store/apps/details?id=dev.msfjarvis.aps https://play.google.com/store/apps/details?id=dev.msfjarvis.... on Android with its password fill integration. It's the best of all worlds and entirely free. I even have my wife set up with the android app just in case something happens to me or she needs common passwords. She doesn't use it for her passwords yet, but baby steps.
- bsima 4y ago
  > Perhaps, pass supports similar functionality now? It does. I use it every day.
colinsane 4y ago
i’ve used `pass` for 4-ish years now. i stopped last month. the interactions between pass and gpg-agent are too opaque for someone who’s not a regular PGP user. what happens when i let my PGP key expire? what’s the right way to share passwords between multiple machines — can i just clone the ~/.gnupg folder, do i need to `export` and then `import` the keys? should i create subkeys for each machine? i want my password manager to be decently transparent, because if i misunderstand its failure modes that’s a big deal. anyway, i’m using SOPS now [1]. it comes with a different set of tradeoffs (doesn’t integrate with keyrings quite as well as GPG does), but it’s way more transparent and pluggable. i generate distinct pubkey/privkey pairs per logical user and i can grant any subset of keys access to specific secrets. so e.g. my desktop and laptop can decrypt my banking secrets, but my phone cannot. i have a nightly backup cronjob which has to run unattended: i encode my Backblaze API key to the `duplicity` user’s privkey, and can safely check the encoded key into public repos and such. it’s simple and easy to grok. more so than pass, IMHO. 1: https://github.com/mozilla/sops https://github.com/mozilla/sops
- robinoh 4y ago
  Just add any second or third (sub)key to .gpg-id inside the password-store dir. I use pass with two separate gpg sub-keys loaded on 2 separate Yubi keys. To unlock passwords, I must have one of the yubikey or my backup master key that's on a encrypted usb. It also works over ssh without cloning the pass repo to a separate machine.
- mariusor 4y ago
  I use multiple keys for encrypting the secrets. It's been going fine for about 5 years and at least two key rotation events. I usually have a key for each device that requires access, sometimes they overlap for all secrets and sometimes they only have access to specific folders (think a work vs. personal separation). It's a high friction environment for sure, but I'm happy with it.
- pxc 4y ago
  > what happens when i let my PGP key expire? You can't encrypt new passwords to it, but you can still read old ones that are encrypted to it. > what’s the right way to share passwords between multiple machines — can i just clone the ~/.gnupg folder, do i need to `export` and then `import` the keys? should i create subkeys for each machine? if the keys are on a hardware smartcard like a Yubikey, I just reuse the key. if not, I use separate keys for separate hosts and encrypt my pass secrets to all of them using the .gpg-id files > anyway, i’m using SOPS now I think SOPS is awesome, too! it's my favorite way to securely store secrets in IaC projects
smartmic 4y ago
Related: https://news.ycombinator.com/item?id=29577272 https://news.ycombinator.com/item?id=29577272
- dang 4y ago
  Thanks! Macroexpanded: Clever uses of pass, the Unix password manager - https://news.ycombinator.com/item?id=29577272 https://news.ycombinator.com/item?id=29577272 - Dec 2021 (148 comments)
bartkappenburg 4y ago
Heard good stories about https://github.com/ossobv/pstore https://github.com/ossobv/pstore. Also for the CLI.
bvrmn 4y ago
Pass is a fascinating project. Can't praise it enough. I've been using pass for eternity and have a big chunk of automation regarding passwords/token/keys for my hobby and work projects. For example I use pass to store TOTP secrets and get a PIN in a sane way. Or use pass to store ansible vault password with ANSIBLE_VAULT_PASSWORD_FILE and a little script to insert password automatically during playbooks runs. Also our CI's numerous automation scripts handle PASS_FILE environ variable to get creds from a pass.
tupolef 4y ago
I was, recently, very happy to switch entirely to KeepassXC, which for me has all the features mentioned here. Most importantly, it serves as my SSH-agent and Sercret-Service, getting rid of the Gnome Keyring. I was currently looking at how to use it as a secret storage in CLI version or with kpcli. But discovering PASS, PASSAGE and SOPS, I'm now very interested in these file-based and modular solutions, more like plain text and future proof. The big concern would be that I will have to put back the Gnome Keyring for the Secret-Service... Big NOPE. Do anyone know a solution for that with SOPS or PASS?
- aaaaaaaaata 4y ago
  > PASSAGE Exactly what it sounds like — a password store that uses age. Super cool.
usrbinbash 4y ago
Free, simple, works in a terminal. Best password manager I ever used.
2pEXgD0fZ5cF 4y ago
Is it possible to attach files to an entry?
turminal 4y ago
Pass is quite nice but calling it 'standard unix password manager' isn't very appropriate given that it depends on bash.

168 points by pmoriarty 4y ago

The only issue i found myself having using stuff like this is syncing to my mobile phone. Currently i am very satisfied with bitwarden due to their firefox extension and mobile ios app which integrates with the ios keychain. Pass sadly isnt usable for me.

0xphk 4y ago
You can use the integrated git feature to sync passwords between all sorts of devices. The nice thing is, that there are pass clients for almost every system including iOS, Android and Windows and with git you simply pull changes in. And by using your own server, you don't have to rely on the security of others to keep your secrets safe.
treffer 4y ago
I am using pass on my Android phone all the time (e.g. to log in to ycombibator right now). I use OpenKeychain (from f-droid) to access my yubikey + Password Store (also in f-droid) for git clone (readonly ssh key) and password filling. It integrates with any input field on the whole system and my phone can't decrypt any passwords alone and it uses standard encryption methods.
- urxvtcd 4y ago
  I think the GP is aware of that, and just decided it's too much of a hassle. I used pass for few years, and have recently switched to bitwarden. I know my way around git well, but I just never remembered to push the new passwords from either my desktop or my phone, which sometimes made me reset the password on one of the devices, and getting conflicts later on, I was always forgetting the password to the SSH key on my phone, and was ever-worried that I don't understand shit about GPG. Two years ago I switched my laptops, and moving the password store to the new one was painful. I'm sure I did something wrong, and that someone who knows what they're doing would have no trouble doing that, but I guess it's not for me. Also, a minor pain point is that generating a new password for an existing login overwrites the whole file, and not only the first line, so I had to copy the other login data from the old file to the new one. I'm sure there's a way around that, but I never bothered.
  - tdido 4y ago
    You can use "-i" for in-place password generation, which will just replace the first line.
j7ake 4y ago
Pass syncs on my iPhone using the pass iOS app.
- captn3m0 4y ago
  Which is adding support for Yubikeys soon.
  - sam_lowry_ 4y ago
    You can use `pass` with Yubikeys, I had this set up for many years
    - captn3m0 4y ago
      The iOS app doesn’t support it yet (the version on the AppStore ie, TestFlight version has had it for a few months - only GPG, not SSH).
stuzenz 4y ago
I have done syncing with pass between multiple clients (and android) using syncthing or git. Either option has worked fine. For some reason I prefer syncthing. The android client works perfectly well.
chriswarbo 4y ago
I use pass on my PinePhone, and sync using git.
Kwpolska 4y ago
I switched from pass to KeePassXC/Keepass2Android (with my .kdbx file living in OneDrive). It’s a much more convenient experience on all platforms. Transparent sync via OneDrive, simple self-contained files and apps, no git and no PGP to mess around with, convenient browser integrations, support for auto-type including working with the the idiotic partial-password thing one of my banks does. pass might be fine if you’re only working with Linux/macOS boxes (although I’d still consider it easy to mess up). If you’re also using Windows, then pass is much less convenient. On Android, the setup with Android-Password-Store and OpenKeychain was pretty fragile and annoying last time I used it.

usr1106 4y ago

Based on git and gpg. So a *ix programmer has full control and full history. And you can move git bundles to offline systems. We used it also as a poor man's vault in a small company, you can have different keys in different directories, not giving everybody access to everything.

sam_lowry_ 4y ago
check gopass, it had some team features built-in while maintaining 100% compatibility with pass
otabdeveloper4 4y ago
It's a nightmare of mish-mashed ill-matching technologies. Glad I managed to escape my passwords and can now store them in a plain text file.

gnull 4y ago

https://rot256.dev/post/pass/ https://rot256.dev/post/pass/ Make sure you understand how exactly it encrypts your data, and what are the things that are still exposed by it.

encryptluks2 4y ago
I give this article a chance, but some assumptions are outright false. For example: > No Post-Quantum security Yeah, no. The beauty of PGP is being able to select your encryption algorithm. Somehow, arguing that AES-256 is more resistant to for example Ed25519 is just factually incorrect and people that use KeePass are not memorizing 40 character passwords to unlock their password manager. > No Service Privacy / Leaks Changes Pass doesn't make assumptions. If you want to encrypt filenames then wrap it with gocryptfs or cryfs or pass-tomb. The nice thing about syncing with pass is having auditable changes that doesn't require a complete database resync. Imagine someone modifying your password store with KeePass. You are not going to have diff to tell what has been changed. With Password Store, you can see exactly what has been changed between syncs. > No authentication of values Again, something that you can change in your PGP settings. I'm not going through the full article, but in all honesty it just sounds like this person doesn't like GnuPG and doesn't understand it. Lest not forget that pass is by the same individual that created wireguard and a slew of other security-focused tools and I think their reputation speaks for itself.
- culpable_pickle 4y ago
  > people that use KeePass are not memorizing 40 character passwords to unlock their password manager. I use a pass phrase that is substantially longer then 40 characters. It doesn’t take too long to sink in.
  - encryptluks2 4y ago
    Fair, but I think that is more of an exception than the norm. For people that may want to more frequently lock their password database, having a 40 character password would quickly become a PITA.

gnull 4y ago

Can pass be unlocked using login password without entering it once more? For example, like Gnome Keyring does.

encryptluks2 4y ago
I believe gpg-agent can connect to Gnome Keyring/Seahorse, but it is usually good to have a reasonable expiration.
gwd 4y ago
AFAICT pass just calls out to gpg; so the answer to your question is, "It does whatever a bare gpg command would do". If you have gpg (or more specifically, gpg-agent) configured to ask for a password every time, using pass will require you to enter in your password every time; if you have gpg-agent configured not to ask within an hour of the previous password, using pass will cause you not to have to enter the password more than once an hour. And of course, if you've just entered your gpg password to decrypt an email with GPGMail (Mac Mail PGP plug-in), you won't have to enter your password to decrypt a password, since they're both using gpg behind the scenes.

jbverschoor 4y ago

What does "the standard" mean?

andrewshadura 4y ago
Nothing. Just marketing.
andreareina 4y ago
Presumably a play on “Ed is the standard text editor.” https://www.gnu.org/fun/jokes/ed-msg.html https://www.gnu.org/fun/jokes/ed-msg.html
- guerrilla 4y ago
  Oh man, I unironically love ed. That was such a clever thing at the time. It's really nice to understand it too, to put the rest in its historical context.

mike_hock 4y ago

It doesn't (and can't) really address the most important issue that there's no secure clipboard and on top of that some desktop environments come with "clipboard history" malware by default that sniffs your clipboard and logs its content to an unencrypted file.

gspr 4y ago
The threat model assumes at least some trust in the system you're running pass on.
weberer 4y ago
Oh boy, wait until you find out how X11 handles keyboard input.
tialaramex 4y ago
You needn't use the clipboard feature, and in fact I think I can count how often I've used it on my fingers after several years. My browser has a pass-compatible agent that requests passwords for web sites when I tell it to do that, if I just want to know an actual human password that's in pass, I run it on the command line and look at my terminal. In my home the visual displays are not recorded ("for training and quality purposes").
0daystock 4y ago
Someone who can sniff your clipboard doesn't need your passwords, they can just lift your cookies or files directly.

yonrg 4y ago

Imho, plain text is the optimal way to store passwords and related meta data. Before pass became popular I started with my own 'plain text pw store', while converting from some db backed $PWSTORE, which became obsolete. So now I'm happy to have it all in a single text file with some markup around. Editing is done with some vim settings like folding, not showing passwords and pushing entries to the clipboard. And here lies the difference. What I was not able to do this with pass: I think I use xclip, which detects if the clipboard was used, after which the pw is removed from the clipboard. No timeout. This enabled me to consecutively send a list of strings to the clipboard. E.g 1. Send URL, 2. Username, 3. Secret. Recently, I added TOTP support. I think pass is not able to do this. I would like to convert over to pass, but my established workflow is to convenient. Well, I haven't checked all the extensions of pass though. Otoh, I would not like to write an extension of my own. Perhaps, pass supports similar functionality now?

endre 4y ago
It would be really easy to implement this, as a wrapper around pass.
mariusor 4y ago
I'm using gopass, which is a mostly API compatible alternative to pass written in go. It definitely has support for xclip/wl-clip.
- andrewstuart2 4y ago
  I'm now using gopass as well, and it's great! Especially with https://github.com/gopasspw/gopassbridge https://github.com/gopasspw/gopassbridge, I get browser auto complete. And https://play.google.com/store/apps/details?id=dev.msfjarvis.aps https://play.google.com/store/apps/details?id=dev.msfjarvis.... on Android with its password fill integration. It's the best of all worlds and entirely free. I even have my wife set up with the android app just in case something happens to me or she needs common passwords. She doesn't use it for her passwords yet, but baby steps.
bsima 4y ago
> Perhaps, pass supports similar functionality now? It does. I use it every day.

colinsane 4y ago

i’ve used `pass` for 4-ish years now. i stopped last month. the interactions between pass and gpg-agent are too opaque for someone who’s not a regular PGP user. what happens when i let my PGP key expire? what’s the right way to share passwords between multiple machines — can i just clone the ~/.gnupg folder, do i need to `export` and then `import` the keys? should i create subkeys for each machine? i want my password manager to be decently transparent, because if i misunderstand its failure modes that’s a big deal. anyway, i’m using SOPS now [1]. it comes with a different set of tradeoffs (doesn’t integrate with keyrings quite as well as GPG does), but it’s way more transparent and pluggable. i generate distinct pubkey/privkey pairs per logical user and i can grant any subset of keys access to specific secrets. so e.g. my desktop and laptop can decrypt my banking secrets, but my phone cannot. i have a nightly backup cronjob which has to run unattended: i encode my Backblaze API key to the `duplicity` user’s privkey, and can safely check the encoded key into public repos and such. it’s simple and easy to grok. more so than pass, IMHO. 1: https://github.com/mozilla/sops https://github.com/mozilla/sops

robinoh 4y ago
Just add any second or third (sub)key to .gpg-id inside the password-store dir. I use pass with two separate gpg sub-keys loaded on 2 separate Yubi keys. To unlock passwords, I must have one of the yubikey or my backup master key that's on a encrypted usb. It also works over ssh without cloning the pass repo to a separate machine.
mariusor 4y ago
I use multiple keys for encrypting the secrets. It's been going fine for about 5 years and at least two key rotation events. I usually have a key for each device that requires access, sometimes they overlap for all secrets and sometimes they only have access to specific folders (think a work vs. personal separation). It's a high friction environment for sure, but I'm happy with it.
pxc 4y ago
> what happens when i let my PGP key expire? You can't encrypt new passwords to it, but you can still read old ones that are encrypted to it. > what’s the right way to share passwords between multiple machines — can i just clone the ~/.gnupg folder, do i need to `export` and then `import` the keys? should i create subkeys for each machine? if the keys are on a hardware smartcard like a Yubikey, I just reuse the key. if not, I use separate keys for separate hosts and encrypt my pass secrets to all of them using the .gpg-id files > anyway, i’m using SOPS now I think SOPS is awesome, too! it's my favorite way to securely store secrets in IaC projects

smartmic 4y ago

Related: https://news.ycombinator.com/item?id=29577272 https://news.ycombinator.com/item?id=29577272

dang 4y ago
Thanks! Macroexpanded: Clever uses of pass, the Unix password manager - https://news.ycombinator.com/item?id=29577272 https://news.ycombinator.com/item?id=29577272 - Dec 2021 (148 comments)

bartkappenburg 4y ago

Heard good stories about https://github.com/ossobv/pstore https://github.com/ossobv/pstore. Also for the CLI.

bvrmn 4y ago

Pass is a fascinating project. Can't praise it enough. I've been using pass for eternity and have a big chunk of automation regarding passwords/token/keys for my hobby and work projects. For example I use pass to store TOTP secrets and get a PIN in a sane way. Or use pass to store ansible vault password with ANSIBLE_VAULT_PASSWORD_FILE and a little script to insert password automatically during playbooks runs. Also our CI's numerous automation scripts handle PASS_FILE environ variable to get creds from a pass.

tupolef 4y ago

I was, recently, very happy to switch entirely to KeepassXC, which for me has all the features mentioned here. Most importantly, it serves as my SSH-agent and Sercret-Service, getting rid of the Gnome Keyring. I was currently looking at how to use it as a secret storage in CLI version or with kpcli. But discovering PASS, PASSAGE and SOPS, I'm now very interested in these file-based and modular solutions, more like plain text and future proof. The big concern would be that I will have to put back the Gnome Keyring for the Secret-Service... Big NOPE. Do anyone know a solution for that with SOPS or PASS?

aaaaaaaaata 4y ago
> PASSAGE Exactly what it sounds like — a password store that uses age. Super cool.

usrbinbash 4y ago

Free, simple, works in a terminal. Best password manager I ever used.

2pEXgD0fZ5cF 4y ago

Is it possible to attach files to an entry?

turminal 4y ago

Pass is quite nice but calling it 'standard unix password manager' isn't very appropriate given that it depends on bash.