Does it piggyback pass, or reimplement everything in its on right?

[forthrin]

[arimxyer]

pass-cli is a complete standalone implementation—it does not use or depend on the Unix pass password manager or GPG.

It implements its own:

• AES-256-GCM encryption for vault storage
• File-based vault format (vault.enc + metadata)
• OS keychain integration (macOS Keychain, Windows Credential Manager, Linux Secret Service)
• TOTP support

The name similarity is coincidental—this is an independent project written in Go.

[forthrin]

Thanks for replying. One would want a comparison table between pass, gopass and pass-cli, and whatever other imitations are out there for the major differences. Keychain sounds like one (ie. if it's one-to-one with what you've stuffed into macOS).

Firefox would be another one. Email passwords in Emacs, fetchmail, Postfix...

And a notification of expired passwords, and generation of new ones...

[arimxyer]

Thanks for the follow-up questions! Let me address each point:

Comparison with pass/gopass

Feature	pass	gopass	pass-cli
Encryption	GPG	GPG	AES-256-GCM
Key management	GPG keyring	GPG keyring	Master password + OS keychain
Recovery	GPG key backup	GPG key backup	BIP39 24-word phrase
Windows support	WSL only	WSL only	Native
Dependencies	GPG, git, tree	GPG, git	None (single binary)
Team/multi-user	Via GPG keys	Built-in	Not currently supported
Git integration	Native	Native	Optional (via rclone)

The main differentiator is simplicity—no GPG setup, no key management, just a master password with optional keychain storage.

Keychain integration

To clarify: pass-cli uses the OS keychain to store your master password only, not individual credentials. This lets you unlock the vault without typing the password each time. Credentials themselves stay in the encrypted vault file—this isolation is intentional for security.

It's not designed to be a system-wide credential provider that other apps (browsers, email clients) can query.

Browser/email integration

pass-cli is positioned as a CLI-first tool for developers—quick access to credentials in scripts, terminals, and automation. It's not aiming to replace 1Password/Bitwarden as a system-wide password manager with browser extensions and app plugins.

For those use cases, Bitwarden (open-source) or the unix pass ecosystem with browser extensions might be better fits for now. However, if there's enough steam behind the engine on this functionality, I'm happy to add it to my roadmap and look into it.

Password generation

This already exists!

pass-cli generate --length 32
pass-cli generate --length 16 --no-symbols

Password expiration tracking

This is an interesting idea worth considering. Tracking when credentials were last rotated and surfacing "stale" passwords could be useful. I'll keep this in mind for future development.

[forthrin]

Thanks for a solid product presentation. Put this front and center for others to get the gist fast. Also, good point, if you're not the next "everything", then tell people how to mix it with their exciting setup. "Where does this piece fit in?"

I love terminals, but there are many other phenomenon that get involved when trying new things.

Keystrokes

As few as possible

Privacy

No accounts, API keys, online dependencies, etc.

Unification

For this type of tool: All passwords in one place, or at least all for a context. It's OK to have passwords in Firefox, as long as you don't need those passwords elsewhere. But once you have to switch contexts, or keep duplicates, you get annoyed.

Reverence

Adhere the UNIX legacy. Go back to the roots and ask what K&R would do. And name it like they would do.

Some people make / change text editors faster than Taylor Swift changes boyfriends.
But more people still use Bash even though Zsh (and other bleeding edges) are better.

As a user, don't jump on bandwagons, wait until the dust settles. You want something you can trust. Especially for pws!
As a dev, you don't really want to make an alternative, you want to become a bundle replacement.

[garylin]

BTW, one benefit I see with git is not only for sync, but also for version control in case some password get deleted accidentally.