Pass: A standard Unix password manager

I&#x27;ve used this for a long time, and along with its Git integration (pushing&#x2F;pulling to&#x2F;from a repository on my own server, accessed over SSH) and a GPG key stored on a Yubikey Neo, I&#x27;ve got basically seamless sync between two laptops, a desktop and an Android phone, without using any third-party service.<p>The &quot;Password Store&quot; app on Android is compatible with `pass` and supports Git and NFC for using the Yubikey Neo to decrypt the passwords.

I recommend using Pass or Keepass, because we can see the source code. But like all these password managers, you need to synchronize your password vault.<p>If you do not want to synchronize your vault among all your devices, but still want to have a unique password per site, try LessPass[1]. LessPass is a stateless open source password manager.<p>Disclaimer I am the creator of LessPass<p>[1] <a href="https:&#x2F;&#x2F;lesspass.com&#x2F;" rel="nofollow">https:&#x2F;&#x2F;lesspass.com&#x2F;</a>

Pass is pretty awesome, but nowadays I&#x27;ve switched to gopass: <a href="https:&#x2F;&#x2F;github.com&#x2F;justwatchcom&#x2F;gopass" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;justwatchcom&#x2F;gopass</a> - much better support for teams, structured secrets, binary secrets and quite a few other improvements. Oh, and it&#x27;s (mostly) drop-in compatible.

I use pass and love it. It provides a lot of flexibility. To fix the &quot;website metadata is leaked in filenames&quot; issue, I use another project by Jason, ctmg[0]. I changed the pass directory to be one directory deeper, encrypted it and just do `ctmg open` when I boot to open my password list (similar to unlocking a keypassX store) then use pass as normal. On shutdown, the opened folder is re-encrypted automatically. You could also set a ctmg close on a timer if you don&#x27;t want the list to be available during your entire session after open.<p>Other things I do:<p>* store all the files as .toml files so I can rip specific keys with a custom script.<p>* Have a directory for web so `pass web` will give me all websites. Have a script to fill username pass for each.<p>* Have a directory for contacts. Then wrote a script to generate vCard files by crawling and pulling keys, base64 profile images and all.<p>* use syncthing to keep all devices up to date.<p>It&#x27;s pretty slick workflow IMHO<p>[0] <a href="https:&#x2F;&#x2F;git.zx2c4.com&#x2F;ctmg&#x2F;about&#x2F;" rel="nofollow">https:&#x2F;&#x2F;git.zx2c4.com&#x2F;ctmg&#x2F;about&#x2F;</a>

Note that pass was developed (and is maintained) by Jason Donenfeld (zx2c4), the same person who developed Wireguard, the new VPN protocol.<p>Not that my opinion is worth a whole lot, but this is the password manager I would choose to use if I wasn&#x27;t using 1Password. Where many other password managers use convoluted constructions with (e.g.) AES and PBKDF2, this is very straightforward GPG.

I don&#x27;t like the fact someone with access to my hard-drive can figure out all the services I&#x27;m using just by looking at the filenames.<p>It&#x27;s convenient yes, but I prefer one encrypted file that contains it all.

With all the discussion about 1password and its decision to &quot;more or less&quot; move to the web and a subscription based model, I had a TODO to look at what the open source community had; especially regarding browser plug-ins, mobile apps, etc. I don&#x27;t understand why a simple problem like password management, needs a subscription and a private company to create software for the problem.<p>This post seems to have saved me the trouble of Googling myself. I am installing on the Mac and iOS as we speak.

I love Pass, but the problem I&#x27;ve had is that I always feel like I have to spend a bunch of time setting it up when I&#x27;m on Windows.<p>I understand it&#x27;s the standard <i>UNIX</i> password manager, so I suppose I don&#x27;t have a ton of room to complain, and most of my computers are Mac or Linux, so it&#x27;s not a huge deal, but I think it increases the barrier of entry a ton of people.<p>That said, I think Pass is awesome, and having my passwords stored in Github makes me really happy.

Using this and something like rofi-pass:<p><a href="https:&#x2F;&#x2F;github.com&#x2F;carnager&#x2F;rofi-pass&#x2F;" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;carnager&#x2F;rofi-pass&#x2F;</a><p>Gets me really close to the holy grail of password managers. Browser integration is possible too with PassFF:<p><a href="https:&#x2F;&#x2F;github.com&#x2F;passff&#x2F;passff" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;passff&#x2F;passff</a>

How does this compare to other popular solutions? Specifically, KeepassX &#x2F; Keepass2 which are the most common solutions I&#x27;ve seen most Unix &#x2F; Linux users employ. Can we objectively state which one is a better solution?

I&#x27;ve been using password managers for while now, but I&#x27;ve recently discovered pass-rotate: <a href="https:&#x2F;&#x2F;github.com&#x2F;SirCmpwn&#x2F;pass-rotate" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;SirCmpwn&#x2F;pass-rotate</a><p>It&#x27;s basically a rotation manager ! Very powerful and lets you properly change your passwords regularly on many websites (like the proprietary Dashlane Password Changer or Lastpass&#x27; similar feature).

Isn&#x27;t copying the password to clipboard a vulnerability?<p>I think a better idea would be to fill in the password through something like xdotool

I wrote a similar password manager (without knowing that pass already exists): <a href="https:&#x2F;&#x2F;github.com&#x2F;snoack&#x2F;mypass" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;snoack&#x2F;mypass</a><p>But I ended up storing everything into one single encrypted file, rather than having one file per password. Though I see the point about the UNIX philosophy (i.e. &quot;everything is a file&quot;), but that way you&#x27;d leak information, i.e. what the passwords stored are for.<p>Anyway, I&#x27;d appreciate any feedback on mypass.

I&#x27;ve seen pass mentioned like a million times but I didn&#x27;t realize there were so many third party extensions for it, the comments here are pretty helpful. Thanks for the submission!

Related: hunter2[0], a password manager which uses a smartcard to manage the keys for each password, and supports multiple users.<p>[0] <a href="https:&#x2F;&#x2F;chiselapp.com&#x2F;user&#x2F;rkeene&#x2F;repository&#x2F;hunter2&#x2F;" rel="nofollow">https:&#x2F;&#x2F;chiselapp.com&#x2F;user&#x2F;rkeene&#x2F;repository&#x2F;hunter2&#x2F;</a>

I started with pass and switched to gopass because it automatically pushes new passwords to your remote git repository.<p>I use a fish script to hook it up to <a href="https:&#x2F;&#x2F;github.com&#x2F;junegunn&#x2F;fzf" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;junegunn&#x2F;fzf</a> for easy search and copying to the clipboard. <a href="https:&#x2F;&#x2F;github.com&#x2F;zabil&#x2F;thanksforallthefish&#x2F;blob&#x2F;6145e98691312361a18cfcdb6eaaf7b2f0a13fce&#x2F;p.fish" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;zabil&#x2F;thanksforallthefish&#x2F;blob&#x2F;6145e98691...</a>

I&#x27;ve been using pass for a long time now. I have over 200 passwords stored.<p>I like it because you can use it to store sensitive info along with metadata, not just single field passwords. It&#x27;s also super easy to access the info on the command line with ways to auto-copy passwords to your clipboard (which expires after 45 seconds).<p>I did a write up on it a while back at <a href="https:&#x2F;&#x2F;nickjanetakis.com&#x2F;blog&#x2F;managing-your-passwords-on-the-command-line-in-linux-with-pass" rel="nofollow">https:&#x2F;&#x2F;nickjanetakis.com&#x2F;blog&#x2F;managing-your-passwords-on-th...</a>.

I use pass on all my devices. IOS, chromebook and cli. I freaking love it! passforios is still on testflight but so good. Only a few issues with passforios:<p>- It forgets my github password everytime i upgrade - I honestly don&#x27;t like the fact that I can&#x27;t turn off the pin. 4 digits with unlimited retries. - It can&#x27;t merge sometimes. I think they should be more aggressive about git rebase

I&#x27;m currently a Lastpass user. I know, trusting them to store my passwords is probably not a great idea but it works on Windows, macOS and Linux and my iPhone with no problems at all.<p>Would I like to move to something that isn&#x27;t stored online? Yes, of course but I haven&#x27;t found a decent solution that works everywhere.<p>Any recommendations?

I think pass is awesome if you have the workflow that supports it, but for the vast majority (myself included) it&#x27;s entirely too difficult to setup and maintain. Particularly if you&#x27;re using Windows regularly.

I&#x27;ve been using this for a while and am very happy. Especially the ability to use a private git repository for synchronization of laptop and desktop makes this convenient.

If you&#x27;re using XMonad, you definitely want to use the pass addon in the xmonad-contrib package: <a href="https:&#x2F;&#x2F;hackage.haskell.org&#x2F;package&#x2F;xmonad-contrib-0.13&#x2F;docs&#x2F;XMonad-Prompt-Pass.html" rel="nofollow">https:&#x2F;&#x2F;hackage.haskell.org&#x2F;package&#x2F;xmonad-contrib-0.13&#x2F;docs...</a><p>I would claim that there isn&#x27;t a more convenient password management solution than this.

Alright guys, I tried using this as I was curious, and miserably failed.<p>Found out I needed GPG, and some encryption key or ID and whatnot. I have no clue what these things are and would like to know.<p>How can I learn about this encryption stuff like keys and RAS and whatnot? (Books n Articles)

For those interested, I&#x27;ve been working on something similar but for journal entries instead of passwords. [1]<p>[1]: <a href="https:&#x2F;&#x2F;github.com&#x2F;schollz&#x2F;gojot" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;schollz&#x2F;gojot</a>

If anyone needs a quick tutorial on pass I wrote about some it&#x27;s features a while back <a href="http:&#x2F;&#x2F;tuxlabs.com&#x2F;?p=450" rel="nofollow">http:&#x2F;&#x2F;tuxlabs.com&#x2F;?p=450</a>

Anybody else here simply hashing their master password with the domain name of the website?<p>I think this is something the browser should offer by default.

Did anyone here NOT write their own pw manager?

Implemented as 700 lines of shell script?! Why?

I&#x27;ve used pass for years, it&#x27;s great.

No, no it&#x27;s not.

If it becomes standard, people would use it without a master password, and then stealing passwords via malicious scripts will become very easy.