gopass
A command-line password manager for teams, built as a drop-in replacement for pass with GPG encryption and git versioning.
What is gopass?
Gopass is a command-line password manager that serves as a drop-in replacement for the standard Unix password manager (pass). It encrypts passwords using GPG (or alternative backends like age) and stores them in a git repository for versioning and team collaboration. It solves the problem of securely managing and sharing credentials across distributed teams and multiple devices.
Developers, system administrators, and distributed teams who prefer command-line tools and need a secure, version-controlled password management solution. It's especially suited for those already familiar with Unix-like workflows and git.
Developers choose Gopass for its seamless integration with existing Unix tools, strong encryption defaults, and team-friendly features like git-based syncing. Its flexibility in backends and offline capability make it a robust, self-hosted alternative to cloud-based password managers.
Overview
The slightly more awesome standard unix password manager for teams
Use Cases
Best For
- Managing passwords in distributed development teams
- Automating credential handling in CI/CD pipelines
- Using a command-line interface for password management
- Self-hosting a password manager with git versioning
- Securely sharing credentials across multiple devices
- Working offline or on air-gapped machines
Not Ideal For
- Users who prioritize graphical interfaces and avoid command-line tools entirely
- Solo individuals seeking a simple, cloud-based password manager with automatic sync and recovery features
- Enterprises requiring built-in administrative controls, audit trails, and centralized user management beyond git
- Non-technical users unfamiliar with GPG key management or version control systems
Pros & Cons
Pros
Built from experience with distributed teams, it supports shared stores and recipient management via git, enabling secure credential sharing across devices and members.
Allows switching encryption to age or storage to fossil, providing adaptability to different security and workflow preferences beyond the default GPG and git setup.
Operates without network connectivity by default, making it suitable for air-gapped machines or environments with restricted internet access, as highlighted in the README.
Command-line interface facilitates seamless integration into scripts and CI/CD pipelines, enhancing automation possibilities for developers and sysadmins.
Cons
Requires configuring GPG keys and git repositories, which can be error-prone and intimidating for users new to encryption or version control, as noted in the installation warnings.
Core functionality depends on tools like GPG and git, adding maintenance overhead and potential points of failure if these are not properly managed or available.
Lacks built-in password recovery mechanisms or a full GUI, placing the onus on users for backup and key management, which can be a risk in team environments.
Frequently Asked Questions
Related Projects
VaultA tool for secrets management, encryption as a service, and privileged access management
How-to-Secure-A-Linux-ServerAn evolving how-to guide for securing a Linux server.
SopsSimple and flexible tool for managing secrets
fail2banDaemon to ban hosts that cause multiple authentication errors
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.