password

KO | EN

gitlite — search

#hacktoberfest #go #golang #machine-learning #deep-learning #linux #docker #nodejs #macos #kubernetes #pytorch #ios #openai #open-source

(★ 12)

The CLI password manager I wrote for me.

password Latest Version Download

Download Latest Version (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

## password
### a command line password manager

**UPDATE**: this has been superceded by the tools in
[cryptutils](https://github.com/kisom/cryptutils).

This a personal password manager, written for me, that operates on the
command line. It stores and retrieves passwords and optional metadata
as well. By default, passwords are stored to `${HOME}/.passwords.db`
(you can see this with `password -h`, observing the default value for
the `-f` flag). This can be changed by passing an argument to the `-f`
flag.

This isn't designed for sharing passwords or anything terribly
complicated. It's essentially a password-protected key-value
store. It's not meant for using with a phone (I avoid using mine as
much as possible).

## Usage

To add a new password (password set):

```
password -s label
```

To retrieve the password for *label*:

```
password label
```

To retrieve a password in a form suitable for exporting to the clipboard:

```
password -x label
```

To change the password for *label* (password set overwriting):

```
password -s -o label
```

To remove the password for *label* (password remove):

```
password -r label
```

To change the master password for the password store:

```
password -c
```

To add metadata to *label* (password store metadata):

```
password -s -m label
```

To view metadata when retrieving the password for *label* (password metadata):

```
password -m label
```

To enter multiple labels and passwords in the same session:

```
password -multi
```

Both entering metadata and multiple labels/passwords will stop when
the first empty line is entered.

## Example

For the sake of argument, let's assume you have three accounts:

* example.net with password "password1"
* example.com with password "password2"
* example.org with password "password3"

The example.com account additionally has three security questions:

* Q. "What is your name?" A. "Sir Lancelot of Camelot"
* Q. "What is your quest?" A. "To seek the Holy Grail"
* Q. "What is your favourite colour?" A. "blue"

Since you're using `password` for the first time, you can enter all
these passwords at once:

```
$ password -multi
Use an empty name to indicate that you are done.
Name: example.net
Password: 
Name: example.com
Password: 
Name: example.org
Password: 
Name: 
Database passphrase: 
$ 
```

If you list the accounts stored:

```
$ password -l
Password store passphrase: 
Names:
        example.com
        example.net
        example.org
```

You can enter the security questions for example.com:

```
$ password -s -m example.com
Password store passphrase: 
Enter metadata; use an empty line to indicate that you are done.
key = value: What is your name? = Sir Lancelot of Camelot
key = value: What is your quest? = To seek the Holy Grail
key = value: What is your favourite colour? = blue
key = value: 
$
```

By default, `password` won't show metadata when retrieving a password:

```
$ password example.com
Password store passphrase: 
Password: "password2"
$
```

You can show metadata with the `-m` flag:

```
$ password -m example.com
Password store passphrase: 
Password: "password2"
What is your quest?="To seek the Holy Grail"
What is your favourite colour?="blue"
What is your name?="Sir Lancelot of Camelot"
```

Perhaps you want to copy the password to the clipboard on your OpenBSD machine:

```
$ password -x example.net | xclip
Password store passphrase: %
```

Over on your Mac, you can do the same with:

```
password -x example.net | pbcopy
Password store passphrase: %
```

Meanwhile, it looks like example.org has changed their privacy policy,
and you don't like the direction they're taking. So, you've deleted
your account there. Time to remove it from `password`:

```
$ password -r example.org
Password store passphrase:
Done.
$
```

If you list your accounts again:

```
 $ password -l
Password store passphrase: 
Names:
        example.com
        example.net
$
```

Some time passes, and you think you should change your master password.

```
$ password -c
Password store passphrase: 
Changing password...
Password store passphrase:
$
```

If you wanted to back up your password database, you can pass around
the binary file, or you can export to PEM.

```
$ password -export -
-----BEGIN PASSWORD STORE-----
z2rNMKINVV/8+hO3pxw9vAlHXieml/5zMt+lGnaQHmcU5cM/X9DmfBnj9Sk0hpsQ
V90j660VOBMuwTHijgkQ0PSqifxZtdRA/5D7mM9Q3j69V/uwbrb3I8akB0vb/Knl
SYI9bikTxnbe2sVb7Vw8Ta3E/Kh1chp8LVHbh6OI+ww/H8jV76MYmp4FW5wApp9y
0AaTa3dMC1O1NctBN6KrPuN0JG//P8fsyEDXwosd3eVqiLfj+tsNUX29rc7pc8yS
LhO248rP2Hv7jhX8Pl/0ynrANJkaVnz+4+pwFbUg2A2WYxv8MBQAZm1gdX2nHEuZ
tQv5gPlfjyPnt2iArgKoSC+07qQ7VSqrSib23tAA/pAQJWYXB8o9GE7B3diOHbvC
ir9ZDvO5P8WEkh5EA10HZjmqj38m1OWlO7bmhtVoDFfHRrpUxMWh+K3hnXnJjGOA
AwTgs8VkDccaOzEnbgDRhvlS3qcrcaGNge4kd65XlUoW2YvzoIoPcoAWX7jiBvpC
eA==
-----END PASSWORD STORE-----

$
```

Maybe you'd rather actually store it to a file, instead of printing to
standard output:

```
$ password -export passwords.pem
$ cat passwords.pem 
-----BEGIN PASSWORD STORE-----
z2rNMKINVV/8+hO3pxw9vAlHXieml/5zMt+lGnaQHmcU5cM/X9DmfBnj9Sk0hpsQ
V90j660VOBMuwTHijgkQ0PSqifxZtdRA/5D7mM9Q3j69V/uwbrb3I8akB0vb/Knl
SYI9bikTxnbe2sVb7Vw8Ta3E/Kh1chp8LVHbh6OI+ww/H8jV76MYmp4FW5wApp9y
0AaTa3dMC1O1NctBN6KrPuN0JG//P8fsyEDXwosd3eVqiLfj+tsNUX29rc7pc8yS
LhO248rP2Hv7jhX8Pl/0ynrANJkaVnz+4+pwFbUg2A2WYxv8MBQAZm1gdX2nHEuZ
tQv5gPlfjyPnt2iArgKoSC+07qQ7VSqrSib23tAA/pAQJWYXB8o9GE7B3diOHbvC
ir9ZDvO5P8WEkh5EA10HZjmqj38m1OWlO7bmhtVoDFfHRrpUxMWh+K3hnXnJjGOA
AwTgs8VkDccaOzEnbgDRhvlS3qcrcaGNge4kd65XlUoW2YvzoIoPcoAWX7jiBvpC
eA==
-----END PASSWORD STORE-----

$
```

Now, you want to import this on another machine:

```
$ password -import passwords.pem
$ password -l                   
Password store passphrase: 
Names:
        example.com
        example.net
$
```

(The password for this example store is "password1", and you can
import it on your machine from PEM to see for yourself.)

It looks like your favourite colour is now yellow, so you'll want to
remove that bit of metadata and re-add it:

```
$ password -r -m example.com
Password store passphrase: 
Keys:
        What is your favourite colour?
        What is your name?
        What is your quest?
Remove key: What is your favourite colour?
Deleted key What is your favourite colour?
Remove key:
$ password -s -m example.com
Password store passphrase: 
Enter metadata; use an empty line to indicate that you are done.
key = value: What is your favourite colour? = yellow
key = value: 
$
```

One of your friends now has a hot startup at example.io, and you want
to add your account there:

```
 $ password -s example.io
Password store passphrase: 
Password:
```

Time passes, and you get an email from example.com that they've had a
database breach, and your password is compromised. As a safety
measure, `password` won't let you just overwrite a password:

```
$ password -s example.com
Password store passphrase: 
[!] entry exists, not forcing overwrite
$
```

You can tell `password` to overwrite the stored passphrase with the
`-o` flag:

```
 $ password -s -o example.com
Password store passphrase: 
[!] *** warning: overwriting password
Password:
$
```

There's not much else to `password`.

## Import / export

The password store can be imported from PEM or exported to PEM. Pass
either "-export" or "-import", and provide the source (when importing)
or destination (when exporting) file as the only argument. If "-" is
used as a filename, `password` will use either standard input or
standard output, as appropriate. This might be useful, for example, in
emailing the file to yourself or storing a printed backup.

## The password store:

The password are stored internally using a Go map; when dumped to
disk, it is first encoded to JSON, then encrypted using NaCl's
secretbox. The key for NaCl is derived using Scrypt (N=32768, r=8,
p=4) with a 32-byte salt that is randomly generated each time the
file is saved. The salt is stored as the first 32 bytes of the file.

I've taken care to attempt zeroing memory and passphrases where I can,
but there are no guarantees this is effective.

### JSON layout

```
{
    "Version": 1,
    "Timestamp": 1400529440,
    "Store": {
        "example.net": {
            "Timestamp": 1400529440,
            "Password": "cGFzc3dvcmQ=",
            "Metadata": {
                "email": "me@example.net"
            }
        },
        "example.org": {
            "Timestamp":  1400537177,
            "Password": "cGFzc3dvcmQy"
        }
    }
}
```

## See also

* [OTPC](https://github.com/kisom/otpc) -- a one-time password /
  two-factor command line client.
* [apg](http://www.adel.nursat.kz/apg/) -- the automated password
  generator. It's in OpenBSD's packages, Ubuntu's repositories, and
  Homebrew (and possibly others that I didn't check). I use this for
  generating passwords.

## License

`password` is released under the ISC license.

password

password Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

password

password Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

Download README