GOKEY(1)

✨ GOKEY ✨

okay bestie, welcome to Gokey's Manual — page one of the GOKEY(1) saga 💖

---

🌸 NAME 🌸

gokey — a simple vaultless password manager in Go. no cap, it's literally in the name 🫶

---

🌈 SYNOPSIS 🌈

gokey [OPTIONS]

that's it. that's the whole vibe. 💅

---

🦋 DESCRIPTION 🦋

so here's the tea, bestie: gokey is a password manager, but the iconic twist is that it does NOT need a password vault. nope. instead of storing your passwords in a vault like some 2010s situation, it derives your password on the fly from your master password plus a realm string you supply (think a resource URL, that kind of thing) ✨

and the way that this changes your LIFE is that you never have to manage, backup, or sync your password vault — and you never have to trust a third party with managing it either 😭 because your passwords are just available immediately, anywhere. periodt. 👑

---

💅 OPTIONS 💅

• -o output_path — by default gokey outputs generated data to stdout. if you want it going somewhere else, this is your girl 🎀
• -P /path/to/password — path to the master password file, which is what gets used to generate other passwords/keys or to encrypt the seed file (peep Modes of operation below). if no master password and no master password file is provided, gokey will ask for it interactively 🫶
• -p master_password — the master password itself, used to generate other passwords/keys or to encrypt the seed file (again, see Modes of operation below). same deal: no master password and no master password file means gokey asks you interactively 💬
• -r password/key_realm — any string that identifies the requested password/key. most likely it's the key usage or the resource URL 🌐
• -s path_to_seed_file — needed if you want to use a seed file instead of a master password as your entropy source (see Modes of operation below). you can generate one with the -t seed flag, as described below 🌱
• -skip number_of_bytes — number of bytes to skip when reading the seed file ⏭️
• -u — UNSAFE ⚠️ allow generating keys without using a seed file (see Modes of operation below). this is the "i know what i'm doing" button and it is literally labeled unsafe, so, like, be aware 💀
• -t password/key_type — the requested password/key output type. supported password/key types are:
  • pass — default, generates a password 🔑
  • seed — generates a seed file, which can be used with the -s option later 🌱
  • raw — generates 32 random bytes (can be used as a symmetric key) 🎲
  • ec256 — generates ECC P-256 private key
  • ec384 — generates ECC P-384 private key
  • ec521 — generates ECC P-521 private key
  • rsa2048 — generates 2048-bit RSA private key
  • rsa4096 — generates 4096-bit RSA private key
  • x25519 — generates x25519 (also known as curve25519) ECC private key
  • ed25519 — generates ed25519 ECC private key
• -l length — number of characters in the generated password, or number of bytes in the generated raw stream. default is 10 for the pass type and 32 for the raw type ✨

---

👑 MODES OF OPERATION 👑

gokey can generate passwords and cryptographic private keys (ECC and RSA keys are currently supported, bestie 🎀). but heads up: with no additional options specified, it uses your master password as a single source of entropy for the generated data. for passwords that's acceptable most of the time, but keys usually have much higher entropy requirements. not me being honest about the entropy situation 😭

for the cases where higher entropy is required for generated passwords/keys, gokey can use a seed file (a blob with random data) instead of the master password as a source of entropy. slay.

🌱 Simple mode (without a seed file) 🌱

in simple mode, passwords are derived directly from your master password and the realm string. that means each unique combination of a master password and a realm string will produce a unique password. the math is mathing 🧮✨

for example, if your master password is super-secret-master-password and you want to generate a password for example.com, you would invoke gokey like

gokey -p super-secret-master-password -r example.com

if you need a password for a different resource, example2.com, you would change the real string

gokey -p super-secret-master-password -r example2.com

this way you need to remember only your master password, and you can always recreate passwords for your services/resources 🫶 iconic behavior, honestly.

NOTE: in this mode, generated passwords are as strong as your master password, so do have your master password strong enough. you can also derive private keys from your master password, but keep in mind that these keys will have low entropy. that is why it is considered unsafe, so gokey does not allow it by default. if you're really know what you are doing, you can override this default by supplying the -u flag 💀

🦋 Using a seed file 🦋

if you plan to generate not only passwords but also private keys, or you want your passwords/keys to have higher entropy, you can use a seed file instead of the master password. you still need to supply a master password when invoking gokey, but it will be used only to protect the seed file itself — all generated passwords/keys will be derived from the data in the seed file ✨

gokey uses seed files protected (encrypted) with your master password, so it is reasonably safe to store/backup seed files to a third party location, such as Google Drive or Dropbox ☁️ (yes bestie, cloud storage is on the menu, that's the whole point 🫶)

to generate an encrypted seed file, use

gokey -p super-secret-master-password -t seed -o seedfile

this will create a seed file seedfile with 256 bytes of random data. the data is encrypted using AES-256-GCM mode and super-secret-master-password as a key 🔐

then, to generate an EC-256 private key for example.com, use

gokey -p super-secret-master-password -s seedfile -r example.com -t ec256

---

🎀 AUTHOR 🎀

Ignat Korchagin ignat@cloudflare.com — thank you for your service, king 👑

---

aaaand that's the whole page bestie 💖 this was gokey, dated 2018-06-06, from the GOKEY(1) manual. go forth and derive responsibly, no cap 🌈💅🦋