gopass

What gopass does

gopass is a password manager you use from the terminal. Each secret is a small encrypted file in a directory tree, so gopass show work/aws decrypts one file and gopass ls lists the tree. It keeps the layout of pass, the standard UNIX password manager, and is meant as a drop-in replacement, but adds features aimed at teams: several stores can be mounted into one tree (for example a personal store plus one per team), each store has its own list of recipients, and gopass sync pulls and pushes every store and its keys.

Besides passwords it stores TOTP seeds and generates codes, holds binary files such as private keys, and understands YAML in secrets so you can read single fields. gopass audit checks for weak passwords offline, and the separate gopass-hibp tool checks secrets against known leaks. An extension API lets you add your own commands.

Security and encryption

By default secrets are encrypted with GnuPG for every recipient listed in the store, which is how sharing works: adding a teammate means adding their public key and re-encrypting. An age backend is also available; the docs call it experimental and say its on-disk format may change.

The project’s security document is unusually frank about the limits. gopass protects the contents of secrets but not their names, so anyone with access to the Git repository can see which secrets exist. It does not yet protect the integrity of a store, and its threat model assumes no attacker on your local machine. Because Git keeps history, a person you remove from a store can still check out old revisions, so the docs say every secret they could read should be changed. No independent audit is documented; the README shows an OpenSSF Scorecard badge, and the security document lists hardening choices such as static binaries without CGo and never building shell command strings.

Self-hosting gopass

There is no gopass server. You install a single Go binary from Homebrew, MacPorts, the project’s Debian repository, Fedora, Arch, Alpine, WinGet, Chocolatey, Scoop or the BSD ports, and most setups also need GnuPG and Git. The README warns Debian and Ubuntu users not to install the distribution package called gopass, which is a different project. To share a store, you push it to any Git remote you control, such as a self-hosted Gitea or GitLab instance.

Hosted version

None. The developers do not run a service; sync goes through whichever Git host you choose.

Limitations

gopass is built for people comfortable with a terminal and with GPG key management, including the web of trust. A browser extension (gopassbridge), a GUI and mobile access come from separate projects, and the mobile apps listed in the docs are third-party pass-compatible apps. Visible secret names and the lack of integrity protection make it a poor fit if file names alone would reveal sensitive information.

Who it suits

gopass fits developers, administrators and small technical teams who already use Git and GPG and want secrets they can script against, from CI/CD jobs, kubectl, Terraform or a Git credential helper. For a graphical, file-based vault, see KeePassXC; for teams that need a web interface and permissions, compare Passbolt. Our password manager guide explains the trade-offs.