I Turned My Terminal Into a Password Manager — Pass, GPG, and Agent-Safe Secrets

1 What is Pass?

Pass (the standard Unix password manager) is a free, open-source CLI tool that stores every password as a GPG-encrypted file on disk. It follows the Unix philosophy: does one thing and does it well.

It can replace both your personal password manager (Instagram, email) and your secrets manager (database keys, API tokens). It's created by Jason Donenfeld — the same researcher who created WireGuard.

Every password = one GPG-encrypted file
Directory-based organization (like a filesystem)
Git-tracked changes out of the box
Extensions for OTP, migration from other managers, and more
Android, iOS, and desktop apps available

2 PGP vs GPG — Clearing the Confusion

▶ 1:31

A subtle detail many people miss:

PGP — "Pretty Good Privacy", the original standard from the 1990s. Now the open standard is called OpenPGP. The commercial product is owned by Broadcom.
GPG — "GnuPG" (GNU Privacy Guard). Implements the same OpenPGP standard but is completely free and open-source.

Pass uses GPG (the free implementation), not PGP (the commercial product).

3 The Creator — Jason Donenfeld

▶ 2:04

Jason Donenfeld (aka zx2c4) is a security researcher most famous for creating WireGuard — the fast, modern VPN protocol used by Tailscale and others. He hosts Pass on his own Git server.

💡 "Six connections on LinkedIn, no experience listed, available only through his email, hosts pass on his own Git server. That's how you know someone's legit these days."

4 GPG Key Setup

▶ 2:29

The only prerequisite for Pass is GPG. Setup:

# Install GPG (Mac)
brew install gnupg

# Generate a key pair
gpg --gen-key
# Choose RSA, maximum key length, no expiry
# Provide name, email, and passphrase

GPG stores keys in ~/.gnupg/. During key generation, it needs entropy (randomness) from keyboard/mouse input — this makes the key unpredictable.

# List your keys
gpg --list-secret-keys --keyid-format long

5 Signing & Encryption Basics

▶ 3:13

Before diving into Pass, a quick GPG demonstration:

# Encrypt a file (--armor = text output instead of binary)
gpg --armor --encrypt --recipient your@email.com secret.txt

# Create a detached signature for verification
gpg --armor --detach-sign secret.txt

# Verify a signature
gpg --verify secret.txt.asc secret.txt

# Decrypt
gpg --decrypt secret.txt.asc

This same cryptographic concept underpins Telegram, WhatsApp, Signal — signing messages for authenticity using public/private key pairs.

6 Pass in Action — Core Commands

▶ 6:36

# Initialize password store
pass init your@email.com    # Creates ~/.password-store/
pass git init               # Enable git tracking

# Insert a password
pass insert social/instagram    # Type password twice

# Retrieve a password
pass social/instagram           # Prints to stdout

# Copy to clipboard (auto-clears after 45 seconds!)
pass -c social/instagram

# Generate a random password
pass generate business/api-key 32

# Directory-based organization
pass business/               # Shows tree of business/ entries

# Search
pass find instagram           # Partial match search

# Edit in $EDITOR
pass edit social/instagram

# Delete
pass rm work/jira

# Move/rename
pass mv old/path new/path

# Multi-line secrets
pass insert -m secrets/db-config  # Type multiple lines

# Show entire store
pass ls

💡 The clipboard feature is genius: pass -c copies the secret and automatically clears it after 45 seconds. Perfect for pasting into login forms without leaving secrets lingering.

7 Git Integration — Built-in Version Control

▶ 8:29

Every Pass operation (insert, edit, delete, move) creates a git commit automatically. The pass git subcommand passes any git command through:

# View history of all password changes
pass git log

# Push to a remote (for sync/backup)
pass git remote add origin git@github.com:user/pass-store.git
pass git push

The file structure is clean: directories and .gpg files. You can explore it with ls or any file browser — the files are encrypted, so even if someone sees the tree, they can't read the values.

8 Extensions & Migration

▶ 9:14

Pass itself is minimal, but the extension ecosystem covers everything:

pass-import — migrate from 1Password, LastPass, KeePass, Apple Keychain, Chrome, and more
pass-otp — one-time password (TOTP) support
pass-update — bulk update operations

⚠️ Reality check: Migration isn't as smooth as you'd expect. "It's not as easy as you think. While very much doable, you have to work a little to make this happen." — Expect some friction importing from paid services.

9 Desktop & Mobile Access

▶ 10:19

Raycast (Mac)

The Raycast extension is the standout desktop experience. Open Raycast → see your entire store → hit the secret → it pastes into whatever app is focused. "Who needs anything else?"

Mobile (iOS/Android)

The Pass app requires:

Push your ~/.password-store to a private GitHub repo
Configure the app with repo path, branch, and GitHub token
Your secrets sync to mobile

10 Per-Repo Secrets for AI Agents — The Killer Use Case

▶ 11:08

This is the feature that makes Pass uniquely powerful for AI-assisted development. Instead of .env files with plaintext secrets (risk of git push), you can create a per-repository password store:

# Set password store to current project directory
export PASSWORD_STORE_DIR="$(pwd)/.password-store"

# Initialize a project-local store
pass init your@email.com

# Insert project secrets
pass insert db-password
pass insert api-key

Automating with mise

Instead of manually exporting the env var every time, use mise (formerly rtx) — the tool for local environment management:

# .mise.toml in your project root
[env]
PASSWORD_STORE_DIR = "{{config_root}}/.password-store"

Now every time you cd into the project, pass automatically points to the project's local store. Your main store is untouched. AI coding agents can safely access secrets via pass show db-password without ever seeing plaintext in .env files.

💡 Why this matters for AI agents: When Claude Code, Codex, or Pi run in your project, they can read secrets via pass show <key> — the secret is decrypted only at the moment of use, never stored in plaintext on disk. No risk of agents accidentally committing secrets to git.

🎯 Key Takeaways

🔑 Key Takeaways

Pass stores every password as a GPG-encrypted file — one file per secret, organized in directories
Created by the WireGuard creator — Jason Donenfeld, a respected security researcher
Git-tracked by default — every insert, edit, delete is automatically committed
Clipboard auto-clear — pass -c copies a secret and wipes it from clipboard after 45 seconds
Extensions cover OTP, migration, and more — import from 1Password, LastPass, Apple Keychain, Chrome
Raycast integration — seamless Mac desktop access without leaving your workflow
Mobile sync via git — push store to private GitHub repo, clone on iOS/Android app
Per-repo password stores — use PASSWORD_STORE_DIR env var to create project-local secret stores
mise automates the env var — .mise.toml sets the store path per-project automatically
AI agent-safe secrets — agents access secrets via pass show, never touching plaintext .env files
Migration isn't frictionless — "it's not as easy as you think" but it's doable with some work

🔗 Resources & Links

Pass — The Standard Unix Password Manager — official site with documentation and extension list

⏱ Timestamp Index

▶ 0:00 Introduction — terminal as password manager

▶ 1:08 Unix philosophy — one thing, done well

▶ 1:31 PGP vs GPG explained

▶ 2:04 Jason Donenfeld & WireGuard

▶ 2:29 GPG key generation

▶ 3:13 Signing, encrypting, verifying

▶ 6:36 Pass init & core commands

▶ 7:35 Clipboard, generate, find, delete

▶ 8:29 Git integration & multi-line secrets

▶ 9:14 Extensions — OTP, import, update

▶ 10:19 Raycast extension & mobile setup

▶ 11:08 Per-repo secrets with PASSWORD_STORE_DIR

▶ 12:06 mise automation for local env management