{"id":51413704,"url":"https://github.com/bsramin/pass-quick-access","last_synced_at":"2026-07-04T17:01:03.134Z","repository":{"id":364399226,"uuid":"1266279051","full_name":"bsramin/pass-quick-access","owner":"bsramin","description":"Native macOS quick access for Proton Pass — hotkey, search, copy username/password/2FA. Built on the official pass-cli.","archived":false,"fork":false,"pushed_at":"2026-06-24T16:29:15.000Z","size":1529,"stargazers_count":15,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-06-24T18:12:25.006Z","etag":null,"topics":["appkit","macos","menubar","pass-cli","password-manager","productivity","proton-pass","quick-access","swift","swiftui"],"latest_commit_sha":null,"homepage":"https://bsramin.github.io/pass-quick-access/","language":"Swift","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/bsramin.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":".github/FUNDING.yml","license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null},"funding":{"github":"bsramin"}},"created_at":"2026-06-11T13:25:05.000Z","updated_at":"2026-06-24T16:29:56.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/bsramin/pass-quick-access","commit_stats":null,"previous_names":["bsramin/pass-quick-access"],"tags_count":2,"template":false,"template_full_name":null,"purl":"pkg:github/bsramin/pass-quick-access","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bsramin%2Fpass-quick-access","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bsramin%2Fpass-quick-access/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bsramin%2Fpass-quick-access/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bsramin%2Fpass-quick-access/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/bsramin","download_url":"https://codeload.github.com/bsramin/pass-quick-access/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bsramin%2Fpass-quick-access/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35129190,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-04T02:00:05.987Z","response_time":113,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["appkit","macos","menubar","pass-cli","password-manager","productivity","proton-pass","quick-access","swift","swiftui"],"created_at":"2026-07-04T17:01:02.445Z","updated_at":"2026-07-04T17:01:03.114Z","avatar_url":"https://github.com/bsramin.png","language":"Swift","funding_links":["https://github.com/sponsors/bsramin","https://github.com/sponsors/bsramin)*"],"categories":[],"sub_categories":[],"readme":"# Pass Quick Access\n\n[![CI](https://github.com/bsramin/pass-quick-access/actions/workflows/ci.yml/badge.svg)](https://github.com/bsramin/pass-quick-access/actions/workflows/ci.yml)\n\n\n![Search](docs/screenshots/app.png)\n\n\nA native macOS quick-access window for [Proton Pass](https://proton.me/pass).\nPress a keystroke from any app, search your logins, and fill or copy a username,\npassword or one-time code, or open the item's site in your browser. The same\nidea as 1Password's Quick Access, built for Proton Pass, which ships an Electron\ndesktop app and no native quick-access of its own.\n\n\u003e Not affiliated with or endorsed by Proton AG.\n\n## 💛 Looking for a sponsor\n\n[![Sponsor](https://img.shields.io/badge/Sponsor-%E2%9D%A4-db61a2?logo=githubsponsors\u0026logoColor=white)](https://github.com/sponsors/bsramin)\n\nThis is a free, open-source side project, and it will stay that way. I'm looking\nfor a **sponsor to cover the Apple Developer Program membership** (99 USD/year).\n\nWith it, I can ship the app **notarized and signed**, so it installs without\nGatekeeper warnings, and add **automatic updates** so everyone stays on the\nlatest version effortlessly. The app would remain **completely free and fully\nopen source** for everyone, forever. The sponsorship pays only for the Apple\nmembership that makes safe, frictionless distribution possible.\n\nIf you or your company would like to help, you can sponsor through\n**[GitHub Sponsors](https://github.com/sponsors/bsramin)**. Your support would be\ncredited here with thanks.\n\nPrefer not to sponsor? You can also sign up for Proton with my\n**[referral link](https://pr.tn/ref/H6KQSW71)**. You get 2 weeks of a paid plan,\nand I get a small reward if you subscribe.\n\n## Screenshots\n\n| Search | Item detail |\n| --- | --- |\n| ![Search](docs/screenshots/search.png) | ![Item detail](docs/screenshots/detail.png) |\n\n## How it works\n\nThe app does not reimplement Proton's authentication or cryptography. It drives\nthe official [`pass-cli`](https://github.com/protonpass/pass-cli), the\nProton-maintained command-line client, and wraps it in a native macOS UI.\n\n```\n   ┌───────────────────────────────────────────┐\n   │ Floating panel (AppKit NSPanel + SwiftUI) │\n   │   hotkey ▸ search ▸ pick ▸ fill / copy    │\n   └───────────────┬───────────────────────────┘\n                   │ metadata only (titles, URLs, usernames)\n   ┌───────────────▼───────────────────────────┐\n   │ PassCLIClient  (actor over pass-cli)      │\n   │   vault list · item list · item view      │\n   └───────────────┬───────────────────────────┘\n                   │ secrets fetched just-in-time, never cached\n   ┌───────────────▼───────────────────────────┐\n   │ pass-cli  ▸  Proton Pass servers          │\n   └───────────────────────────────────────────┘\n```\n\n## Features\n\n- **Floating search panel** summoned by a global hotkey (default ⌥⇧Space,\n  configurable). It opens over any app without pulling you out of it, and\n  dismisses when it loses focus.\n- **Search that matches Proton Pass**: the same substring, diacritic-insensitive,\n  multi-word matching as the official client, over titles, usernames, emails,\n  URLs, notes and custom fields. Matches are ranked by relevance, so a hit in the\n  title comes before one buried in a URL or note; with no query, items fall back\n  to most recently modified or alphabetical order.\n- **Fill or copy**, each action shown only when the item has that field:\n  - Fill Login (types the username, a Tab, then the password), or Fill Username,\n    Fill Password and Fill One-Time Code on their own\n  - Copy Username, Copy Password, Copy One-Time Code\n  - Open in Browser, with a chooser when an item has several URLs\n- **Autofill into the app you came from**: rather than copy, the app types the\n  login into the focused field of whatever was frontmost, in any browser or app,\n  by sending real keystrokes. Pick whether choosing an item fills, copies, or\n  both under **Settings → Autofill**. Filling needs macOS Accessibility access.\n- **Knows the page you're on**: open the panel over a browser and the item for\n  the current tab is selected for you; when several match the same site, the list\n  is filtered to those. Safari and Chromium browsers are read over Automation;\n  Firefox, Zen and web apps are opt-in, since reading them turns on their\n  accessibility engine.\n- **Keyboard driven**: arrows to move, Page Up/Down and Home/End to jump, `→`\n  to open an item, `←` to step back, `esc` to close. ⌘↩ fills the login, the\n  ⌘C family copies.\n- **Resume**: reopen within 30 seconds of an action and you land back on the\n  same item, to grab another field.\n- **Optional Touch ID lock** with a configurable timeout, falling back to your\n  Mac password.\n- **Stays signed in**: when your Proton Pass session expires, the panel offers a\n  one-click sign-in that opens Proton's web login in your browser, then reloads\n  itself and the SSH agent once you're back. Optionally save a Personal Access\n  Token (in the Keychain, behind Touch ID) to reconnect without the browser,\n  reusing your next Touch ID. Set it up under **Settings → Account**.\n- **Website icons** are off by default; items show a locally generated monogram.\n  You can opt in to fetching favicons, with a clear notice of what that shares.\n  Favicons are never fetched for local or private addresses, including hostnames\n  that resolve to one, so the feature stays off your local network.\n\n## SSH agent\n\nAn optional SSH agent serves your Proton Pass SSH keys to `git` and `ssh`, the\nway 1Password's does, and asks for Touch ID before every signature, naming the\napp that requested it. It is off by default; turn it on under **Settings → SSH**.\n\n![SSH key signature request with Touch ID](docs/screenshots/ssh-agent.png)\n\nIt does not hold keys or sign anything itself. `pass-cli` already ships an SSH\nagent that stores the keys and does the signing; this app runs a thin **proxy**\nin front of it that adds the native confirmation. Private keys never enter the\napp, consistent with the security model below. Repeated signatures within a few\nseconds aren't re-prompted, you can mark an app trusted so it stops asking, and\nnon-interactive `BatchMode` probes are denied without a prompt.\n\n### Setting it up\n\n1. **Store an SSH key in Proton Pass.** SSH keys live under *Custom item* (the\n   \"Other\" type) in the Proton Pass apps. `pass-cli ssh-agent debug --vault-name\n   \u003cname\u003e` lists which of your items are usable as SSH keys.\n2. **Enable the agent** in *Settings → SSH*. The app starts the upstream\n   `pass-cli` agent for you (it fetches your keys from Proton, so the status\n   reaches *Running* after a few seconds).\n3. **Point SSH at the proxy.** Flip on *Configure ~/.ssh/config automatically* and\n   the app writes the entry for you (and removes it when you turn it back off):\n   ```\n   Host *\n       IdentityAgent ~/.ssh/pass-quick-access-agent.sock\n   ```\n   For most people that's all you need: `ssh` and `git` read `~/.ssh/config`. Some\n   tools ignore it and only look at the `SSH_AUTH_SOCK` environment variable\n   (`ssh-add`, some GUI clients, certain scripts). If you use those, also enable\n   *Set SSH_AUTH_SOCK for new programs*: it publishes the proxy socket to your\n   login session via `launchctl`, so they pick it up too. It applies to programs\n   launched afterwards, so quit and reopen a terminal (or app) for it to take\n   effect.\n4. **Use `git` and `ssh` normally.** Each signature pops a Touch ID prompt naming\n   the app and key. Check the keys are served with:\n   ```sh\n   SSH_AUTH_SOCK=~/.ssh/pass-quick-access-agent.sock ssh-add -l\n   ```\n\n### Migrating from 1Password\n\nThe workflow is the same one you already know:\n\n- Move (or recreate) your SSH keys as Proton Pass items, and register the public\n  keys with your servers / GitHub as usual.\n- Let the app write its `~/.ssh/config` entry (step 3 above), then **remove\n  1Password's own `IdentityAgent` line** and turn off its SSH agent. The app only\n  manages its own block, so anything another tool added is yours to clean up.\n- **Gotcha shared by every agent:** an explicit on-disk `IdentityFile` for a host\n  takes precedence over the agent, so `ssh` uses the file (and prompts for its\n  passphrase) instead of asking the agent. Remove the `IdentityFile` lines for\n  the hosts you want served from Proton Pass.\n\n## Security model\n\n- **Secrets are never persisted or indexed.** The in-memory index holds only\n  titles, URLs, usernames and the presence of a password or one-time code, never\n  the secret values. Passwords and codes are read fresh from `pass-cli` at the\n  moment you copy them, handed to the pasteboard, and the pasteboard entry is\n  marked concealed and cleared after 30 seconds.\n- **Authentication lives in `pass-cli`.** The app holds no Proton credentials and\n  relies on the CLI's existing session.\n- **The trust boundary is that session.** Anyone who can run code as your user\n  can already read everything through `pass-cli` directly, so the app is careful\n  not to be a weaker link: nothing is written to disk, and signed release builds\n  use the hardened runtime without `get-task-allow` so other processes can't\n  attach.\n- An optional Touch ID lock guards casual access to an unlocked Mac. It is not a\n  defense against local code execution.\n\n## Requirements\n\n- macOS 14 or later\n- [`pass-cli`](https://github.com/protonpass/pass-cli) installed and logged in\n  (`pass-cli login`). The CLI requires a paid Proton Pass plan.\n- [XcodeGen](https://github.com/yonaskolb/XcodeGen) to generate the project\n\n## Build and run\n\n```sh\nxcodegen generate\nxcodebuild -scheme PassQuickAccess -destination 'platform=macOS' -derivedDataPath build build\nopen build/Build/Products/Debug/PassQuickAccess.app\n```\n\nRun the tests with:\n\n```sh\nxcodebuild -scheme PassQuickAccess -destination 'platform=macOS' test\n```\n\n`PassQuickAccess.xcodeproj` is generated from `project.yml` and is not checked\nin. By default the project builds ad-hoc signed; to sign with your own Apple\nDeveloper identity, copy `Config/Local.xcconfig.example` to\n`Config/Local.xcconfig` and fill in your team.\n\n## Limitations\n\n- The CLI is the only supported way in. There is no public Proton Pass API, so\n  the app is as capable as `pass-cli` and no more.\n- Ordering uses the item's modification time. The official app also factors in\n  last-use time, which `pass-cli` does not expose. If you'd like it to, vote for\n  [this Proton feature request](https://protonmail.uservoice.com/forums/953584-proton-pass-authenticator/suggestions/51396523-cli-expose-and-update-last-used-time-for-items).\n- Distribution is currently build-from-source. A notarized release needs an\n  Apple Developer ID certificate (a paid Apple Developer Program membership);\n  [sponsoring the project](https://github.com/sponsors/bsramin) would help cover\n  it, so builds could open without a Gatekeeper prompt.\n\n## Contributing\n\nSee [CONTRIBUTING.md](CONTRIBUTING.md). Security reports go through\n[SECURITY.md](SECURITY.md).\n\n## License\n\n[GNU General Public License v3.0](LICENSE). This is a community project and is\nnot affiliated with or endorsed by Proton AG.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbsramin%2Fpass-quick-access","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fbsramin%2Fpass-quick-access","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbsramin%2Fpass-quick-access/lists"}