pass

From Gentoo Wiki
Jump to:navigation Jump to:search
This article is a stub. Please help out by expanding it - how to get started.

pass is a command-line password manager that stores, retrieves, generates, and synchronizes passwords securely. It integrates directly with the user's PGP keys to store password in encrypted format on disk. Pass is written in Bash and was created by Gentoo developer Jason A. Donenfeld (Zx2c4) .

Installation

USE flags

USE flags for app-admin/pass Stores, retrieves, generates, and synchronizes passwords securely

+git Use dev-vcs/git for password revisions.
X Use x11-misc/xclip to copy passwords to the clipboard.
dmenu Add support for x11-misc/dmenu with the 'passmenu' program.
emacs Add support for GNU Emacs
importers Allow importing passwords from other password managers using various contributed scripts.
wayland Enable dev-libs/wayland backend
Data provided by the Gentoo Package Database · Last update: 2026年05月02日 05:04 More information about USE flags

Emerge

root #emerge --ask app-admin/pass

Additional software

Plugins

Browser add-ons

Compatible tools

Configuration

For initial steps and configuration read the pass man pages:

user $man pass


Environment variables

  • PASSWORD_STORE_DIR — Overrides the default password storage directory.
  • PASSWORD_STORE_KEY — Overrides the default gpg key identification set by init.
  • PASSWORD_STORE_GPG_OPTS — Additional options to be passed to all invocations of GPG.
  • PASSWORD_STORE_X_SELECTION — Overrides the selection passed to xclip.
  • PASSWORD_STORE_CLIP_TIME — Specifies the number of seconds to wait before restoring the clipboard, by default 45 seconds.
  • PASSWORD_STORE_UMASK — Sets the umask of all files modified by pass, by default 077.
  • PASSWORD_STORE_GENERATED_LENGTH — The default password length if the pass-length parameter to generate is unspecified.
  • PASSWORD_STORE_CHARACTER_SET — The character set to be used in password generation for generate.
  • PASSWORD_STORE_CHARACTER_SET_NO_SYMBOLS — The character set to be used in no-symbol password generation.
  • PASSWORD_STORE_ENABLE_EXTENSIONS — This environment variable must be set to "true" for extensions to be enabled.
  • PASSWORD_STORE_EXTENSIONS_DIR — The location to look for executable extension files, by default $PASSWORD_STORE_DIR/.extensions.
  • PASSWORD_STORE_SIGNING_KEY — If this environment variable is set, then all .gpg-id files and non-system extension files must be signed using a detached signature using the GPG key specified by the full 40 character uppercase fingerprint in this variable. If multiple fingerprints are specified, each separated by a whitespace character, then signatures must match at least one. The init command will keep signatures of .gpg-id files up to date.
  • EDITOR — The location of the text editor used by edit.

Files

  • ~/.password-store — The default password storage directory.
  • ~/.password-store/.gpg-id — Contains the default gpg key identification used for encryption and decryption. Multiple gpg keys may be specified in this file, one per line. If this file exists in any sub directories, passwords inside those sub directories are encrypted using those keys. This should be set using the init command.
  • ~/.password-store/.extensions — The directory containing extension files.

Initial Setup

Most likely when you first invoke pass you'll get output that looks something like this:

user $pass
Error: password store is empty. Try "pass init".

Without additional configuration, if you run pass init as directed, you'll get the following output:

user $pass init
Usage: pass init [--path=subfolder,-p subfolder] gpg-id...

To initialize your password store:

user $pass init <your_gpg_key_id>

To confirm everything is correct, run pass with no arguments and you should see an empty password store:

user $pass
Password Store

pass integrates well with Git to store changes, even configuring a diff filter so that git log -p works automatically to show decrypted secrets. To set that up, just run:

user $pass git init

Usage

pass is flexible. Entry names can be URLs, usernames, email addresses. The user chooses the hierarchy, but it can also be relocated later at-will. For example, pass generate me/calendar/larry@example.com is valid, as is pass generate example.com.

Any format can be used within the entries created, but there are some conventions relied upon by e.g. PassFF for autofill to work correctly.

The first line is almost always the password itself. The rest varies: sometimes explicit field names are given and sometimes not.

A common style is as follows:

user $pass edit gentoo/larry
asekritpassword
username: larry
url: https://bugs.gentoo.org/

One can also encode the username (or indeed URL) in the path to the entry.

pass-otp

Adding a pass entry for the user larry:

user $pass edit gentoo/larry

Example pass entry generating (OTP) one-time passwords:

user $pass show gentoo/larry
otpauth://totp/larry@gentoo?secret=ZBURIWIVW5UQP4F5PYZ75LHTXU======

Generating a (OTP) one-time password using pass otp command:

user $pass otp gentoo/larry
076884

ViM

Tip
Users of Vim or Neovim should configure the editor not to write the password to disk when using pass edit command, which can inadvertently happen with options such as swapfile and undofile. There is a plugin to set the appropriate options when the editor is editing a password file at https://dev.sanctum.geek.nz/cgit/vim-redact-pass.git. Like other Vim plugins, this can be installed using a plugin manager or by placing the files in an appropriate location manually.

Invocation

user $pass --help
============================================
= pass: the standard unix password manager =
= =
= v1.7.4 =
= =
= Jason A. Donenfeld =
= Jason@zx2c4.com =
= =
= http://www.passwordstore.org/ =
============================================
Usage:
 pass init [--path=subfolder,-p subfolder] gpg-id...
 Initialize new password storage and use gpg-id for encryption.
 Selectively reencrypt existing passwords using new gpg-id.
 pass [ls] [subfolder]
 List passwords.
 pass find pass-names...
 List passwords that match pass-names.
 pass [show] [--clip[=line-number],-c[line-number]] pass-name
 Show existing password and optionally put it on the clipboard.
 If put on the clipboard, it will be cleared in 45 seconds.
 pass grep [GREPOPTIONS] search-string
 Search for password files containing search-string when decrypted.
 pass insert [--echo,-e | --multiline,-m] [--force,-f] pass-name
 Insert new password. Optionally, echo the password back to the console
 during entry. Or, optionally, the entry may be multiline. Prompt before
 overwriting existing password unless forced.
 pass edit pass-name
 Insert a new password or edit an existing password using /usr/bin/vim.
 pass generate [--no-symbols,-n] [--clip,-c] [--in-place,-i | --force,-f] pass-name [pass-length]
 Generate a new password of pass-length (or 25 if unspecified) with optionally no symbols.
 Optionally put it on the clipboard and clear board after 45 seconds.
 Prompt before overwriting existing password unless forced.
 Optionally replace only the first line of an existing file with a new password.
 pass rm [--recursive,-r] [--force,-f] pass-name
 Remove existing password or directory, optionally forcefully.
 pass mv [--force,-f] old-path new-path
 Renames or moves old-path to new-path, optionally forcefully, selectively reencrypting.
 pass cp [--force,-f] old-path new-path
 Copies old-path to new-path, optionally forcefully, selectively reencrypting.
 pass git git-command-args...
 If the password store is a git repository, execute a git command
 specified by git-command-args.
 pass help
 Show this text.
 pass version
 Show version information.
More information may be found in the pass(1) man page.

Removal

Unmerge

root #emerge --ask --depclean --verbose app-admin/pass

See also

External resources