pw

pw

A command-line password manager and cryptography tool designed to be low-tech and easy to use. It has a few specific properties I like, namely:

• Symmetric encryption with a single password (NaCL Secretbox and Argon2 key derrivation). You can clone the password vault around (~/.passwords) to new machines and decrypt it without any private keys.
• The password vault itself is just ciphertext that reveals no information about the keys that are in it.
• Copies keys to the clipboard for entering into webpages without showing the password in plaintext.
• Version control secrets file that can go back to previous versions, and auto-syncs to a remote. Useful for bad password changes and accidental removals.

Tutorial

Install the tool with

go get -u github.com/kingishb/pw

Ensure git is installed on your machine.

Create a password vault

pw init

This will prompt you for a password to store the passwords. The vault is stored as an encrypted json blob in ~/.passwords, which is itself a git repository. Each vault change is a new commit. Add a remote origin to backup each change.

Add a password

pw set example.com

and type in the vault password when prompted, and then save your password to the vault.

Retrieve the password with

pw get example.com

This will copy the password to your clipboard.

List all keys in the vault with

pw ls

Add a file to the vault

pw file myfile.txt

Encrypt a file in place (does not change vault)

pw encrypt myfile.txt

Decrypt a file in place (does not change vault)

pw decrypt myfile.txt

All commands

$ pw
NAME:
   pw - A password manager and cryptography tool.

USAGE:
   pw [global options] command [command options] [arguments...]

VERSION:
   1.0.0

COMMANDS:
     init, i     initializes a password vault in ~/.passwords
     get, g      get a password and copy to clipboard
     rotate      rotate vault password
     show        prints a password to the terminal
     set, s      set a password for a given key
     rm          remove a password from the vault
     list, ls    list passwords in the vault
     copy, cp    copy key from one name to another
     move, mv    move a key from one name to another
     dump        dump all passwords to stdout as json
     load        bulk load a json file of passwords
     make        makes a new password for a key
     file, f     save contents of a file
     encrypt, e  encrypts a file inplace with a password, must fit in memory
     decrypt, d  decrypts a file with a password, must fit in memory
     help, h     Shows a list of commands or help for one command

GLOBAL OPTIONS:
   --help, -h     show help
   --version, -v  print the version```