{"id":35272633,"url":"https://github.com/arimxyer/pass-cli","last_synced_at":"2026-03-08T16:06:10.371Z","repository":{"id":317466084,"uuid":"1067536464","full_name":"arimxyer/pass-cli","owner":"arimxyer","description":"A secure, cross-platform, always-free, and open-source alternative to 1password, bitwarden, etc., Password and API key manager for folks who live in the command line. (CLI + TUI)","archived":false,"fork":false,"pushed_at":"2026-01-31T20:13:32.000Z","size":11589,"stargazers_count":37,"open_issues_count":2,"forks_count":1,"subscribers_count":2,"default_branch":"main","last_synced_at":"2026-02-01T07:36:39.297Z","etag":null,"topics":["1password","api-key-management","api-keys","bitwarden-cli","cli","password","passwords","secret-manager","secrets","secrets-management","tui"],"latest_commit_sha":null,"homepage":"https://arimxyer.github.io/pass-cli/","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/arimxyer.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-10-01T02:08:06.000Z","updated_at":"2026-01-31T20:13:36.000Z","dependencies_parsed_at":"2025-10-01T04:18:59.691Z","dependency_job_id":"db5b44b2-ebed-44de-b3d7-50dce9350411","html_url":"https://github.com/arimxyer/pass-cli","commit_stats":null,"previous_names":["ari1110/pass-cli","arimxyer/pass-cli"],"tags_count":35,"template":false,"template_full_name":null,"purl":"pkg:github/arimxyer/pass-cli","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/arimxyer%2Fpass-cli","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/arimxyer%2Fpass-cli/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/arimxyer%2Fpass-cli/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/arimxyer%2Fpass-cli/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/arimxyer","download_url":"https://codeload.github.com/arimxyer/pass-cli/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/arimxyer%2Fpass-cli/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29208240,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-02-07T20:33:12.493Z","status":"ssl_error","status_checked_at":"2026-02-07T20:30:47.381Z","response_time":63,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["1password","api-key-management","api-keys","bitwarden-cli","cli","password","passwords","secret-manager","secrets","secrets-management","tui"],"created_at":"2025-12-30T12:59:49.685Z","updated_at":"2026-02-07T21:15:09.008Z","avatar_url":"https://github.com/arimxyer.png","language":"Go","readme":"\u003cp align=\"center\"\u003e\n  \u003cimg src=\"docsite/static/images/social-preview.png\" alt=\"Pass-CLI\" width=\"600\"\u003e\n\u003c/p\u003e\n\n\u003cp align=\"center\"\u003e\n  \u003cstrong\u003eA secure, cross-platform, always-free, and open-source alternative to 1password, bitwarden, etc., Password and API key manager for folks who live in the command line. (CLI + TUI) \u003c/strong\u003e\n\u003cp align=\"center\"\u003e\n  \u003cimg src=\"https://img.shields.io/github/v/release/arimxyer/pass-cli?label=Version\" alt=\"Version\"\u003e\n  \u003cimg src=\"https://img.shields.io/github/last-commit/arimxyer/pass-cli?label=Last%20Updated\" alt=\"Last Updated\"\u003e\n\u003c/p\u003e\n\nPass-CLI is a fast, secure password and API key manager that stores credentials locally with AES-256-GCM encryption. Built for developers who need quick, script-friendly access to credentials without cloud dependencies.\n\n📚 **[View Full Documentation](https://arimxyer.github.io/pass-cli/)** | [Getting Started](docs/01-getting-started/quick-start.md) | [Installation](docs/01-getting-started/quick-install.md) | [Usage Guide](docs/03-reference/command-reference.md)\n\n## Key Features\n\n- **Military-Grade Encryption**: AES-256-GCM with hardened PBKDF2 key derivation (600,000 iterations)\n- **BIP39 Recovery Phrase**: 24-word recovery phrase for vault password reset (industry-standard mnemonic)\n- **System Keychain Integration**: Windows Credential Manager, macOS Keychain, Linux Secret Service\n- **Password Policy Enforcement**: Complexity requirements for vault and credential passwords\n- **Vault Backup \u0026 Restore**: Manual backups with integrity verification and automatic backup during vault operations\n- **Tamper-Evident Audit Logging**: Optional HMAC-signed audit trail for vault operations\n- **Health Checks**: Built-in `doctor` command for vault verification and troubleshooting\n- **Cross-Platform**: Single binary for Windows, macOS (Intel/ARM), and Linux (amd64/arm64)\n- **Script-Friendly**: Clean output modes (`--quiet`, `--field`, `--masked`) for shell integration\n- **Usage Tracking**: Automatic tracking of where credentials are used across projects\n- **Local-First**: Works offline by default, optional cloud sync via rclone\n- **Cloud Sync**: Sync vault across devices with rclone (Google Drive, Dropbox, OneDrive, S3, etc.)\n- **Interactive TUI**: Terminal UI for visual credential management\n- **TOTP / 2FA Support**: Store TOTP secrets and generate 6-digit codes - no separate authenticator app needed\n\n## Quick Start\n\n### Installation\n\n**macOS / Linux (Homebrew)**:\n```bash\nbrew tap arimxyer/homebrew-tap\nbrew install pass-cli\n```\n\n**Windows (Scoop)**:\n```powershell\nscoop bucket add arimxyer https://github.com/arimxyer/scoop-bucket\nscoop install pass-cli\n```\n\nFor manual installation and other methods, see [docs/01-getting-started/manual-install.md](docs/01-getting-started/manual-install.md).\n\n### Getting Started\n\n```bash\n# Initialize vault (choose: new vault or connect to synced vault)\npass-cli init\n\n# Add your first credential\npass-cli add github\n# Enter username and password when prompted\n\n# Retrieve a credential\npass-cli get github\n\n# List all credentials\npass-cli list\n\n# Use in scripts (quiet mode)\nexport API_KEY=$(pass-cli get myservice --quiet --field password)\n```\n\nFor detailed usage and examples, see [docs/01-getting-started/quick-start.md](docs/01-getting-started/quick-start.md).\n\n## Interactive TUI Mode\n\nPass-CLI includes a Terminal User Interface for visual credential management:\n\n![Pass-CLI TUI](docsite/static/images/tui-demo.png)\n\n```bash\n# Launch TUI mode (no arguments)\npass-cli\n\n# CLI commands work with explicit subcommands\npass-cli list\n```\n\n**Key Features**:\n- Visual navigation with arrow keys and Tab\n- Interactive forms for adding/editing credentials\n- Password visibility toggle with `p` (or `Ctrl+P` in forms)\n- Search and filter with `/`\n- Customizable keyboard shortcuts\n- Responsive layout (requires 60x30 minimum terminal size)\n\nPress `?` in TUI mode to see all keyboard shortcuts. For complete TUI documentation and configuration, see [docs/03-reference/command-reference.md](docs/03-reference/command-reference.md).\n\n## Core Commands\n\n```bash\n# Initialize vault\npass-cli init\n\n# Add credential\npass-cli add github --url https://github.com --notes \"Personal account\"\n\n# Get credential (formatted display)\npass-cli get github\n\n# Get credential (script-friendly)\npass-cli get github --quiet --field password\n\n# List all credentials\npass-cli list\n\n# Update credential\npass-cli update github --username newuser@example.com\n\n# Delete credential\npass-cli delete github\n\n# Generate password\npass-cli generate --length 32\n\n# Remove vault\npass-cli vault remove\n\n# Create manual vault backup\npass-cli vault backup create\n\n# Preview backup contents (without restoring)\npass-cli vault backup preview --file vault.enc.backup\n\n# Restore vault from backup\npass-cli vault backup restore\n\n# View backup status\npass-cli vault backup info\n\n# Enable cloud sync (on existing vault)\npass-cli sync enable\n\n# Health check (includes sync status)\npass-cli doctor\n```\n\nFor complete command reference, flags, and examples, see [docs/03-reference/command-reference.md](docs/03-reference/command-reference.md).\n\n## Security\n\n**Encryption**:\n- AES-256-GCM with PBKDF2-SHA256 key derivation (600,000 iterations)\n- Unique salt per vault, unique IV per credential\n- Built-in authentication tag prevents tampering\n\n**Password Policy**:\n- Minimum 12 characters with uppercase, lowercase, digit, and special symbol requirements\n- Enforced for both vault and credential passwords\n\n**Keychain Integration**:\n- Master password stored in OS keychain (Windows Credential Manager, macOS Keychain, Linux Secret Service)\n- Automatic unlock when needed\n- Enable: `pass-cli keychain enable`\n- Check status: `pass-cli keychain status`\n- Disable: Use OS credential manager (see [Keychain Setup](docs/02-guides/keychain-setup.md#disable-keychain-integration))\n- TUI auto-unlocks when keychain is enabled\n\n**BIP39 Recovery Phrase**:\n- 24-word mnemonic phrase generated during vault initialization\n- Recover vault access if you forget your master password\n- Industry-standard BIP39 (same as hardware wallets)\n- 6-word challenge for recovery (2^66 combinations)\n- Optional passphrase protection (25th word)\n- Recover: `pass-cli change-password --recover`\n- Skip during init: `pass-cli init --no-recovery`\n- See [Recovery Guide](docs/02-guides/recovery-phrase.md) for details\n\n**Audit Logging** (Enabled by Default):\n- Tamper-evident HMAC-SHA256 signed audit trail\n- Automatically enabled during `pass-cli init` (use `--no-audit` to disable)\n\n**Vault Location**:\n- Windows: `%USERPROFILE%\\.pass-cli\\vault.enc`\n- macOS/Linux: `~/.pass-cli/vault.enc`\n\nFor complete security details, best practices, and migration guides, see [docs/03-reference/security-architecture.md](docs/03-reference/security-architecture.md).\n\n## Documentation\n\n**Essential Guides**:\n- [Getting Started](docs/01-getting-started/quick-start.md) - First-time setup and basic workflows\n- [Usage Guide](docs/03-reference/command-reference.md) - Complete command reference, TUI shortcuts, configuration\n- [Installation](docs/01-getting-started/quick-install.md) - All installation methods and package managers\n- [Recovery Phrase](docs/02-guides/recovery-phrase.md) - BIP39 recovery phrase setup and vault recovery\n- [Security](docs/03-reference/security-architecture.md) - Encryption details, best practices, migration guides\n- [Troubleshooting](docs/04-troubleshooting/faq.md) - Common issues and solutions\n\n**Additional Resources**:\n- [Cloud Sync](docs/02-guides/sync-guide.md) - Sync vault across devices with rclone\n- [Health Checks](docs/05-operations/health-checks.md) - Doctor command diagnostics\n- [CI/CD Integration](docs/06-development/ci-cd.md) - GitHub Actions and pipeline examples\n- [Branch Workflow](docs/06-development/branch-workflow.md) - Git workflow for contributors\n\n## Building from Source\n\n**Prerequisites**: Go 1.25 or later\n\n```bash\n# Clone and build\ngit clone https://github.com/arimxyer/pass-cli.git\ncd pass-cli\ngo build -o pass-cli .\n\n# Run tests\ngo test ./...\n```\n\nFor testing guidelines, see the [test README](test/README.md). For Git workflow, see the [branch workflow guide](docs/06-development/branch-workflow.md).\n\n## FAQ\n\n### How is this different from `pass` (the standard Unix password manager)?\n\nPass-CLI offers system keychain integration (no GPG required), built-in clipboard support, usage tracking, cross-platform Windows support, script-friendly output modes (`--quiet`, `--field`, `--masked`), and single binary distribution.\n\n### Is my data stored in the cloud?\n\nBy default, no. Pass-CLI stores everything locally on your machine. However, you can optionally enable [cloud sync](docs/02-guides/sync-guide.md) via rclone to sync your encrypted vault across devices. Your vault is always encrypted before sync.\n\n### How do I backup my vault?\n\nUse the built-in backup command:\n```bash\npass-cli vault backup create\n```\n\nThis creates a timestamped manual backup. View all backups with `pass-cli vault backup info`.\n\n### What happens if I forget my master password?\n\nIf you enabled the BIP39 recovery phrase during vault initialization (default), you can recover access:\n```bash\npass-cli change-password --recover\n```\n\nYou'll need your 24-word recovery phrase. The system will ask for 6 random words to verify, then you can set a new master password.\n\nIf you skipped recovery phrase setup (`--no-recovery`) or don't have your recovery phrase, the vault is unrecoverable. Keep your master password and recovery phrase safe.\n\nFor more details, see [Recovery Phrase Guide](docs/02-guides/recovery-phrase.md).\n\nFor more questions and troubleshooting, see [docs/04-troubleshooting/faq.md](docs/04-troubleshooting/faq.md).\n\n## Roadmap\n\nHave a feature request? Open an issue on [GitHub](https://github.com/arimxyer/pass-cli/issues).\n\n## Contributing\n\nContributions are welcome! See [docs/06-development/branch-workflow.md](docs/06-development/branch-workflow.md) for Git workflow and contribution guidelines.\n\n## License\n\nThis project is licensed under the Apache License 2.0. See the [LICENSE](LICENSE) file for details.\n\n## Links\n\n- **Releases**: [GitHub Releases](https://github.com/arimxyer/pass-cli/releases)\n- **Issues**: [GitHub Issues](https://github.com/arimxyer/pass-cli/issues)\n- **Discussions**: [GitHub Discussions](https://github.com/arimxyer/pass-cli/discussions)\n\n---\n\nMade with ❤️ by developers, for developers.\n","funding_links":[],"categories":["Go","Table of Contents"],"sub_categories":[],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Farimxyer%2Fpass-cli","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Farimxyer%2Fpass-cli","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Farimxyer%2Fpass-cli/lists"}