pass

Last reviewed Sep 13, 2026 · 860 words

pass is a bash script. Under 1,000 lines of it, wrapped around two tools you probably already have, gpg and git, and that is the entire product. Each secret is one GPG-encrypted file in ~/.password-store/, the directory tree is your folder structure, and versioning plus sync is plain git. There is no server to run, no database, no web interface and no port. Self-hosting pass means self-hosting a git remote, which you may already do, and deciding how much of the ecosystem of clients you want on top.

The storage model is the reason to choose it

Every other password manager asks you to trust its vault format. pass asks you to trust GPG and the filesystem. pass insert work/github writes ~/.password-store/work/github.gpg, encrypted to the key IDs listed in .gpg-id. pass work/github decrypts it to stdout, pass -c work/github copies it to the clipboard for 45 seconds, and pass generate work/github 24 creates a random 24-character one. Because each entry is a file, grep, find, rsync and every backup tool you own already understand your vault.

The transparency cuts both ways. Filenames are not encrypted, so anyone with read access to the store learns you have an account at banks/hsbc even if they cannot open it. If that matters to your threat model, use vaguer names or accept that pass leaks metadata that a Bitwarden-style blob does not.

Sync is a git remote, and that is the self-hosted part

pass git init turns the store into a repository; every insert, edit and remove becomes a commit. Add a remote on a forge you run, such as Gitea or Forgejo, or a bare repository over SSH on any box:

pass git remote add origin [email protected]:me/password-store.git
pass git push -u origin main

Then pass git pull and pass git push on each machine. The remote only ever sees encrypted files and a history of which filenames changed, so a compromised forge is inconvenient rather than catastrophic, provided your GPG private key never leaves your devices. The dangerous part is not the remote; it is your key. Back up the private key to at least one offline location, and store the key's passphrase somewhere that is not the password store itself.

Adding a browser, a phone and TOTP

Bare pass covers a terminal. Three additions cover normal life. Browserpass is a Firefox and Chrome extension with a native host that fills logins from the store; passff is the Firefox-only alternative. On Android, Password Store (often called APS) clones the git repo and decrypts with OpenKeychain. On iOS, Pass for iOS does the same with its own key handling. The pass-otp extension adds pass otp work/github for 2FA codes, storing an otpauth:// URI in the entry.

Each of these is a separate project with its own maintainer, and this is the honest cost of pass. A GPG key in three places, a git remote, two extensions and two phone apps is a system you assemble and keep working. When the Android app changes how it handles keys, it is your Tuesday evening. GPG itself carries the usual sharp edges: key expiry surprising you, pinentry not appearing over SSH, an agent cache timing out mid-command.

When Vaultwarden is the wiser pick

Vaultwarden gives you official Bitwarden apps on every platform, shared collections for a family, browser autofill that just works, and a single Docker container that idles at about 128 MB. For a household, or for anyone who will not enjoy GPG, it is the better tool, and the Vaultwarden guide is the route. KeePassXC is the middle option: one encrypted database file, no GPG, synced by whatever file sync you already run.

pass wins for a single technical user who lives in a terminal, wants secrets usable from scripts (export TOKEN=$(pass show api/hetzner)), and values a format that will still be readable in 20 years with nothing but gpg -d. It is GPL-2.0, has 4,200 stars, and has been essentially finished since 2012, which for this kind of tool is a virtue. Sharing is possible by adding a second key ID to .gpg-id for a subfolder and re-encrypting with pass init -p shared key1 key2, but that is the extent of team features. gopass is a Go reimplementation with better multi-user support if you outgrow that.

What I'd do

Solo developer: pass with a bare git repo over SSH on your own server, Browserpass in the desktop browser, pass-otp for the handful of TOTP secrets you use from scripts, and a printed paper backup of the GPG key in a safe place. Anyone with a spouse, kids or colleagues who need access: Vaultwarden, no contest. Do not try to make pass a family password manager; the tool is superb at the one job it was designed for and awkward at every other one, and other password managers have better answers for the rest.