Pass: Unix Password Manager

works great.

* Your secret key can be stored in Yubikey, handled by a dedicated OpenPGP agent. This allows deriving a strong key from a weak one. Your password is basically a short PIN with max 3 tries. Every password retrieval can require a physical touch. This is convenient and secure!

Pass makes sense if you use it with a hardware key, with touch enabled. With this setup, it’s hard to beat its security.

* It uses public key cryptography, and comes with its advantages. You don’t need your master password to add/encrypt passwords. You only need that for decryption. Less exposure of master key, and more convenience.

For that reason, it’s well suited to share passwords with other people or devices. You can encrypt to multiple public keys. This adds multi user and device support.

You can easily add a backup offline public key (which you may print) if you lose your Yubikey.

* You can decrypt a single password without decrypting and exposing other passwords. The passwords are isolated, if you use Yubikey.

* Searching passwords is quick and transparent. You easily see what is in your store.

* You can use it programmatically, eg, your backup script can grab a password from the store.

* It’s a short bash script that you can verify, and delegates encryption to a dedicated well-audited cryptographic tool.

* PGP is a standard, and GPG and git are widely available. There is no database to break or migrate. You can read your passwords anywhere and in the future.

* The script is written by the creator of the acclaimed Wireguard!

There are also cons.

* Some people don’t like that it leaks metadata (filenames, and password tree), though there are versions of pass that fix it.

* Lately gpg is causing some troubles with Debian Trixie. GPG agent frequently locks the Yubikey and requires restarting pcscd (probably due to conflicts with pcscd). There is a similar tool Passage using Age, maybe that solves it.

* There are mobile apps, but they are not as frequently updated as something like Bitwarden apps (which has client for every OS, and frequently fixes bugs and adds functionality).

* I haven’t used and not sure how good browser support is.

Here is a post on a similar password management with GPG replaced with Age

https://words.filippo.io/passage/

I used pass for a while but couldn’t see what threat model it actually solves:

If you let GPG agent cache your key, any script (e.g. an npm post-install) can just run `pass ls` or `pass my/secrets` and dump all your credentials. At that point it’s basically just full-disk encryption with extra steps—might as well keep everything in ~/passwords.txt.

If you don’t cache the key, you’re forced to type your long GPG password every single time you need a secret.

I tried a YubiKey for on-demand unlocking, but the integration is clunky and plugging it in constantly is a pain if you need passwords multiple times per hour.

I eventually switched to Bitwarden.

https://github.com/drduh/YubiKey-Guide

This guide covers many adjacent topics; the relevant part is generating the secret key inside Yubikey, or in an airgapped system and doing “key-to-card” in gpg.

    #!/bin/sh
    
    set -eu
    
    k=$(pass ARG)
    oathtool -b --totp "$k"