CheatPress

pass Unix password manager

Version 1.7.4 · source

pass, Postcard, light preview Light · Postcard 102 × 152 mm · PDF pass, Postcard, dark preview Dark · Postcard 102 × 152 mm · PDF pass, Postcard, ink saver preview Ink saver · Postcard 102 × 152 mm · PDF
pass, A5, light preview Light · A5 148 × 210 mm · PDF pass, A5, dark preview Dark · A5 148 × 210 mm · PDF pass, A5, ink saver preview Ink saver · A5 148 × 210 mm · PDF
pass, A4, light preview Light · A4 210 × 297 mm · PDF pass, A4, dark preview Dark · A4 210 × 297 mm · PDF pass, A4, ink saver preview Ink saver · A4 210 × 297 mm · PDF
pass, A4 landscape, light preview Light · A4 landscape 297 × 210 mm · PDF pass, A4 landscape, dark preview Dark · A4 landscape 297 × 210 mm · PDF pass, A4 landscape, ink saver preview Ink saver · A4 landscape 297 × 210 mm · PDF
pass, A3, light preview Light · A3 297 × 420 mm · PDF pass, A3, dark preview Dark · A3 297 × 420 mm · PDF pass, A3, ink saver preview Ink saver · A3 297 × 420 mm · PDF
pass, A3 landscape, light preview Light · A3 landscape 420 × 297 mm · PDF pass, A3 landscape, dark preview Dark · A3 landscape 420 × 297 mm · PDF pass, A3 landscape, ink saver preview Ink saver · A3 landscape 420 × 297 mm · PDF
pass, Letter, light preview Light · Letter 8.5 × 11 in · PDF pass, Letter, dark preview Dark · Letter 8.5 × 11 in · PDF pass, Letter, ink saver preview Ink saver · Letter 8.5 × 11 in · PDF
pass, Tabloid, light preview Light · Tabloid 11 × 17 in · PDF pass, Tabloid, dark preview Dark · Tabloid 11 × 17 in · PDF pass, Tabloid, ink saver preview Ink saver · Tabloid 11 × 17 in · PDF

Start here

gpg --list-secret-keys
Find your key ID
pass init <gpg-id>
Create the store
pass insert <name>
Save a password
pass generate <name> 20
Make a random one
pass -c <name>
Copy to clipboard
pass
List the tree
pass git init
Track with git
pass git push
Sync to a remote

Concepts

  1. Plain text typed or generated
  2. GPG file name.gpg in the store
  3. Git remote optional backup

Setup

pass init <gpg-id>
Create the store for a GPG key
Re-encrypts existing entries if the key changes. Pass several IDs to share the store.
pass init -p <subfolder> <gpg-id>
Use a different key for a folder
Writes a .gpg-id in that folder.
pass git init
Turn the store into a git repo
Commits existing contents; later changes are committed automatically.
pass git remote add origin <url>
Add a remote to the store
pass version
Show version
pass help
Show usage
PASSWORD_STORE_DIR=<dir> pass
Use another store location
Default is ~/.password-store.
PASSWORD_STORE_ENABLE_EXTENSIONS=true
Enable user extensions

Browse

pass
List all entries as a tree
Same as pass ls; needs the tree tool.
pass ls <folder>
List one folder
pass find <name>
List entries whose name matches
pass grep <text>
Search inside decrypted entries
Decrypts every file; extra options go to grep, e.g. -i.
pass grep -i <text>
Search ignoring case

Read

pass show <name>
Print an entry
pass <name>
Print an entry (shortcut)
pass -c <name>
Copy the first line to the clipboard
Clipboard is cleared after 45 seconds.
pass -c<N> <name>
Copy line N instead
pass -q <name>
Show as a QR code
Needs qrencode.
PASSWORD_STORE_CLIP_TIME=<sec>
Change the clipboard timeout
PASSWORD_STORE_X_SELECTION=primary
Use the primary selection for -c

Add and edit

pass insert <name>
Add an entry, typed twice hidden
pass insert -m <name>
Add a multi-line entry
Finish with Ctrl+D.
pass insert -e <name>
Add an entry with visible input
pass insert -f <name>
Overwrite without asking
pass edit <name>
Edit an entry in $EDITOR
Temp files go to /dev/shm when available.
pass generate <name> <length>
Generate a random password
pass generate -n <name> <length>
Generate without symbols
pass generate -c <name> <length>
Generate and copy, do not print
pass generate -i <name> <length>
Replace only the first line
Keeps the other lines of the entry.
pass generate -f <name> <length>
Overwrite without asking
PASSWORD_STORE_GENERATED_LENGTH=<n>
Default generated length
PASSWORD_STORE_CHARACTER_SET=<set>
Characters allowed in generate
Interpreted by tr.

Organise

pass mv <old> <new>
Rename or move an entry
Re-encrypts for the destination's keys.
pass cp <old> <new>
Copy an entry
pass rm <name>
Delete an entry
Asks for confirmation.
pass rm -r <folder>
Delete a folder
pass rm -f <name>
Delete without asking
pass mv -f <old> <new>
Move, overwriting silently
pass mv <name> <folder>/
Move into a folder
A trailing slash forces folder treatment.

Git sync

pass git log
Show store history
pass git push
Push the store
pass git pull
Pull changes from the remote
pass git status
Check for uncommitted changes
pass git clone <url> ~/.password-store
Restore on a new machine
Import your GPG secret key first.
pass git config pass.signcommits true
Sign store commits

Teams and security

pass init <id1> <id2>
Encrypt for several recipients
PASSWORD_STORE_KEY=<ids> pass
Override the key for this run
PASSWORD_STORE_GPG_OPTS=<opts>
Extra options for every gpg call
PASSWORD_STORE_SIGNING_KEY=<fingerprint>
Require signed .gpg-id files
Takes full 40-character fingerprints.
PASSWORD_STORE_UMASK=<mask>
Permissions for new files

Recipes

First setup
gpg --list-secret-keys --keyid-format longpass init <gpg-id>pass git initpass generate email/work 24
Sync to a new machine
gpg --import <secret-key-file>pass git clone <url> ~/.password-storepass -c email/work
Store extra fields
pass insert -m site/example# line 1: password# line 2: user: me@example.com
Rotate a password
pass generate -i site/example 24pass git push