GOPASS(1)

📦
version 1.17.4 · 4 versions
, in arch rolling, nixpkgs unstable

💖 GOPASS(1) — the standard Unix password manager, bestie edition 💖

okay so this is gopass(1), from the User Commands manual, and honestly? it's the moment. it's giving "your passwords are safe and also your life is together." stay with me, there's a lot here and every single bit of it matters 🫶

✨ NAME ✨

gopass — literally the standard Unix password manager. that's it. that's the whole name section. iconic. 💅

🎀 SYNOPSIS 🎀

gopass [global options] command [command options] [,arguments...]

so you got your global options, then your command, then that command's own options, then the args. the , before arguments... is literally in there, don't come for me, I'm just the messenger 😭

✨ GLOBAL OPTIONS ✨

these bad boys work no matter which command you're running. global. universal. main character energy. 👑

  • --alsoclip, -C — copies the password and shows everything. you get both. greedy in the best way 🍓
  • --chars — print specific characters from the secret. like, picky but make it useful ✨
  • --nofuzzysearch — do NOT start fuzzy search when an entry isn't found. no vibes-based guessing for you 🙈
  • --noparsing, -n — do not parse the output. raw. unfiltered. 💀
  • --nosync — disable auto-sync. sometimes you just don't wanna 💅
  • --password, -o — display only the password. it takes precedence over all other flags, so this is the boss flag fr fr
  • --qr — print the password as a QR Code. scan it with your phone, chaos ensues 🌈
  • --qrbody — print the body as a QR Code. same energy, different part of the secret
  • --revision, -r — show a past revision. does NOT support RCS specific shortcuts. use the exact revision, or -<N> to select the Nth oldest revision of this entry. put some respect on the history 🕰️
  • --safe, -s — do not display unsafe content (e.g. the password) even if safecontent is disabled. extra careful baby 🎀
  • --unsafe, -u, -f — display unsafe content (e.g. the password) even if safecontent is enabled. living dangerously, love that for you 🔥
  • --yes, -y — always answer yes to yes/no questions. no more ~prompts~, we're committing 🫡

🌈 COMMANDS 🌈

🧚 age

age commands

built-in commands for the age backend ✨ these allow limited interactions with the gopass specific age identities.

okay so: added identities are automatically added as recipient to your secrets when encrypting — but not to your recipients, so make sure you keep your recipients and identities in sync the way you want to. all age identities, including plugin ones, should be supported. we also still support github identities despite them being deprecated by age — we do so by falling back to the ssh identities for these and keeping a local cache of ssh keys for a given github identity. 🫶

Flags

  • --age-ssh-key-path — custom path to additional SSH key or directory of keys for the age backend
  • --age-sshkeys — load SSH keys from the default SSH directory

🦋 alias

print domain aliases

prints defined domain aliases. short, sweet, slays. 💅

🔍 audit

decrypt all secrets and scan for weak or leaked passwords

this command decrypts all secrets and checks for common flaws and (optionally) against a list of previously leaked passwords. it's the vibe check your password store has been avoiding 😭

Flags

  • --format — output format. text, csv, html or json. Default: text
  • --full — print full details of all findings. Default: false
  • --output-file, -o — output filename. used for csv and html
  • --summary — print a summary of the audit results. Default: true (print summary)
  • --template — HTML template. if not set, use the built-in default.

⭐ cat

decode and print content of a binary secret to stdout, or encode and insert from stdin

this command is similar to the way cat works on the command line. it can either be used to retrieve the decoded content of a secret similar to cat file, or vice versa to encode the content from STDIN to a secret. same energy, password-store edition 🐈

🌸 clone

clone a password store from a git repository

this command clones an existing password store from a git remote to a local password store. can be either used to initialize a new root store or to add a new mounted sub-store. needs at least one argument (git URL) to clone from. accepts a second argument (mount location) to clone and mount a sub-store, e.g. gopass clone git@example.com/store.git foo/bar ✨

Flags

  • --check-keys — check for valid decryption keys. generate new keys if none are found.
  • --crypto — select crypto backend [age gpgcli plain]
  • --path — path to clone the repo to
  • --storage — select storage backend [cryptfs fossilfs gitfs jjfs]

💜 config

display and edit the configuration file

this command allows for easy printing and editing of the configuration 🎀

  • no argument → the entire config is printed
  • a single argument → a single key can be printed
  • two arguments → a setting specified by key can be set to value

Flags

  • --store — set options to a specific store

🧚 convert

convert a store to different backends

convert a store to a different set of backends. glow-up but for storage 🔥

Flags

  • --crypto — which crypto backend? [age gpgcli plain]
  • --move — replace store?
  • --storage — which storage backend? [cryptfs fossilfs fs gitfs jjfs]
  • --store — specify which store to convert

🍓 copy

copy secrets from one location to another

this command copies an existing secret in the store to another location. this also works across different sub-stores 🫶 if the source is a directory it will automatically copy recursively — in that case, the source directory is re-created at the destination if no trailing slash is found, otherwise the contents are flattened (similar to rsync). no cap, that trailing slash is load-bearing 💅

Flags

  • --commit-message, -m — set the commit message
  • --force, -f — force to copy the secret and overwrite existing one
  • --interactive-commit, -i — open an editor for the commit message

✨ create

easy creation of new secrets

this command starts a wizard to aid in creation of new secrets 🧙‍♀️ not me trusting the wizard with my entire digital life

Flags

  • --force, -f — force path selection
  • --store, -s — which store to use

💀 delete

remove one or many secrets from the store

this command removes secrets. it can work recursively on folders. recursing across stores is purposefully not supported — that's a hard no, bestie 🙅‍♀️

Flags

  • --commit-message, -m — set the commit message
  • --force, -f — force to delete the secret
  • --interactive-commit, -i — open an editor for the commit message
  • --recursive, -r — recursive delete files and folders

🩺 doctor

check your gopass installation for common issues

runs a series of diagnostic checks on the gopass installation: binary dependencies, git configuration, store permissions, recipient key validity, and git remote connectivity. exits with a non-zero status if any check fails. so if it's mad, it's actually mad 😭

Flags

  • --recipients — run a detailed recipient consistency diagnostic (canonical IDs, missing keys, .public-keys/ status)
  • --verbose, -v — show passing checks in addition to warnings and errors

🎀 edit

edit new or existing secrets

use this command to insert a new secret or edit an existing one using your $EDITOR 🖊️ it will attempt to create a secure temporary directory for storing your secret while the editor is accessing it. please make sure your editor doesn't leak sensitive data to other locations while editing — fr fr, this one matters 🙈

Note: if $EDITOR is not set we will try editor. if that's not available either we fall back to vi. consider using update-alternatives --config editor to change the defaults.

Flags

  • --commit-message, -m — set the commit message
  • --create, -c — create a new secret if none found
  • --editor, -e — use this editor binary
  • --force — force overwriting and encrypting even if none of your local keys is among the recipients
  • --interactive-commit, -i — open an editor for the commit message

🌈 env

run a subprocess with a pre-populated environment

this command runs a sub process with the environment populated from the keys of a secret. your secrets, but make them environment variables 💅

Flags

  • --exec — replace the current process with the subprocess via exec(3) rather than spawning a child process (not supported on Windows)
  • --file — write each secret to a ramdisk temp file and export KEY_FILE=/path instead of KEY=value
  • --keep-case, --kc — do not capitalize the environment variable and instead retain the original capitalization
  • --stdin — pipe the secret's password to the subprocess's stdin instead of setting an environment variable

🔎 find

search for secrets

this command will first attempt a simple pattern match on the name of the secret. if there is an exact match it will be shown directly; if there are multiple matches, a selection will be shown 🫶

Flags

  • --json, -j — output matches as JSON array
  • --regex, -r — interpret pattern as regular expression
  • --unsafe, -u — in the case of an exact match, display the password even if safecontent is enabled

🛠️ fsck

check store integrity, clean up artifacts and possibly re-write secrets

check the integrity of the given sub-store or all stores if none are specified. will automatically fix all issues found, i.e. it will change permissions, re-write secrets and remove outdated configs 🔧 it will touch your stuff, so like, know that going in 💀

Flags

  • --decrypt — decrypt and reencrypt during fsck.
  • --store — limit fsck to this mount point

🦋 fscopy

copy files from or to the password store

this command either reads a file from the filesystem and writes the encoded and encrypted version in the store, or it decrypts and decodes a secret and writes the result to a file. either source or destination must be a file and the other one a secret 🔁 if you want the source to be securely removed after copying, use gopass fsmove ✨

🧚 fsmove

move files from or to the password store

this command either reads a file from the filesystem and writes the encoded and encrypted version in the store, or it decrypts and decodes a secret and writes the result to a file. either source or destination must be a file and the other one a secret.

the source will be wiped from disk or from the store after it has been copied successfully and validated. so yeah, it's gone-gone 💀 if you don't want the source to be removed, use gopass fscopy 🙈

🔥 generate

generate a new password

dialog to generate a new password and write it into a new or existing secret. by default, the new password will replace the first line of an existing secret (or create a new one). fresh password, who dis 👑

Flags

  • --clip, -c — copy the generated password to the clipboard
  • --commit-message, -m — set the commit message
  • --edit, -e — open secret for editing after generating a password
  • --force, -f — force to overwrite existing password
  • --force-regen — force full re-generation, incl. evaluation of templates. will overwrite the entire secret! 🚨 not a drill
  • --generator, -g — choose a password generator, use one of: cryptic, memorable, xkcd or external. Default: cryptic
  • --interactive-commit, -i — open an editor for the commit message
  • --print, -p — print the generated password to the terminal
  • --strict — require strict character class rules
  • --symbols, -s — use symbols in the password
  • --xkcd-capitalize, --xkcdcapitalize — capitalize first letter of each word in the generated XKCD password

and that's the first chunk, bestie — there's more where this came from, don't go anywhere 🌸

  • --xkcd-lang, --lang, --xkcdlang — which language the XKCD password gets generated in 🌍 currently only en (english, and that's the default) or de are supported
  • --xkcd-numbers, --xkcdnumbers — tacks a random number onto the end of the generated XKCD password 🔢
  • --xkcd-sep, --sep, --xkcdsep — the word separator for generated XKCD passwords ✨ and if you don't specify one, bestie, the words get smooshed together with no spaces/separator at all and the first character of the words gets capitalised

git 🧚

Run a git command inside a password store:

gopass git [--store=<store>] <git-command>

Ok so if your password store is a git repository, this literally just executes a git command specified by git-command-args. That's it. That's the vibe 💅

Flags

  • --store — the store to operate on

grep 🔍

Search for secrets files containing search-string when decrypted.

This one decrypts all the secrets and does a pattern match on the content. All of them. Every single one. She's thorough 👑

Flags

  • --regexp, -r — interpret the pattern as a RE2 regular expression

history 🕰️

Show password history.

Displays the change history for a secret. Iconic for when you're like "wait what was it before I rotated it" 😭

Flags

  • --password, -p — include passwords in the output

init 🌱

Initialize a new password store.

Sets up new password storage and uses gpg-id for encryption 💖

Flags

  • --crypto — select the crypto backend [age, gpgcli, plain]
  • --path, -p — set the sub-store path to operate on
  • --storage — select the storage backend [cryptfs, fossilfs, fs, gitfs, jjfs]
  • --store, -s — set the name of the sub-store

insert ✍️

Insert a new secret.

Inserts a new secret, obviously 💅 Optionally it can echo the secret back to the console while you're typing it. Or, optionally, the entry can be multiline. And it'll prompt you before overwriting an existing secret — unless you force it, of course 😌

Flags

  • --append, -a — append data read from STDIN to existing data
  • --commit-message — set the commit message
  • --echo, -e — display the secret while typing
  • --force, -f — overwrite any existing secret and do not prompt to confirm recipients
  • --interactive-commit, -i — open an editor for the commit message
  • --multiline, -m — insert using $EDITOR

Create a symlink.

Makes a symlink from one entry in a mounted store to another entry 🫶

⚠️ Important: it does not cross mounts! Like, at all. Do not come for her about it 💀

list 📋

List existing secrets.

Lists all existing secrets, duh. Give it a folder prefix and it'll only list certain subfolders of the store — highkey useful when your store is a whole ecosystem 🌸

Flags

  • --flat, -f — print a flat list
  • --folders, -d — print a flat list of folders
  • --json, -j — output as JSON array
  • --limit, -l — display no more than this many levels of the tree
  • --strip-prefix, -s — strip this prefix from filtered entries

merge 🫂

Merge multiple secrets into one.

This is the dedupe workflow, bestie. It needs exactly one destination (it may already exist) and at least one source (which must exist, and can be multiple). Then gopass merges all the entries into one, drops you into an editor, saves the result and removes all the merged entries ✨

Flags

  • --delete, -d — remove merged entries
  • --force, -f — skip the editor, merge entries unattended

mounts 🗂️

Edit mounted stores.

Displays all mounted password stores, and offers several subcommands to create or remove mounts 🎀

move 🚚

Move secrets from one location to another.

Moves a secret from one path to another — and yes it works across different sub-stores, she's versatile like that 💁‍♀️

And here's the detail you don't wanna miss: if the source is a directory, the source directory is re-created at the destination if there's no trailing slash. Otherwise the contents are flattened (similar to rsync). So that trailing slash is load-bearing, fr fr 😭

Flags

  • --commit-message, -m — set the commit message
  • --force, -f — force the move and overwrite the existing one
  • --interactive-commit, -i — open an editor for the commit message

otp 🔐

Generate time- or hmac-based tokens.

Tries to parse an OTP URL (otpauth://). The URL can be TOTP or HOTP. And you can provide the URL on its own line, or on a key value line with a key named 'totp' 🌈

Flags

  • --alsoclip, -C — copy the time-based token and show it
  • --chained, -p — chain the token to the password
  • --clip, -c — copy the time-based token into the clipboard
  • --password, -o — only display the token
  • --qr, -q — write QR code to FILE
  • --snip, -s — scan screen content to insert a OTP QR code into the provided entry

process 🧵

Process a template file.

It reads the template file and replaces all variables with their values ✨

Flags

(no flags here, she's a self-starter 💅)

pull ⬇️

Pull a store from its remote.

Pulls the selected store from its configured remote. And if no remote or branch is specified, the storage backend defaults get used — no cap 👑

Flags

  • --store, -s — select the store to pull

push ⬆️

Push a store to its remote.

Pushes the selected store to its configured remote. Same deal: no remote or branch specified? Storage backend defaults, babes 💖

Flags

  • --store, -s — select the store to push

pwgen 🎲

Generate passwords.

Prints any number of passwords to the console. The optional length parameter sets the length of each password ⭐

Flags

  • --ambiguous, -B — do not include characters that could be easily confused with each other, like '1' and 'l' or '0' and 'O' 🫶
  • --memorable, -m — use the memorable (word-based) password generator. The requested length is a minimum (output may be longer). Incompatible with --no-numerals (memorable always includes digits)
  • --memorable-capitalize, --memorablecapitalize, --mc — capitalize (some) words in the generated memorable password. This flag implies --memorable
  • --no-capitalize, -A — do not include capital letters in the generated passwords
  • --no-numerals, -0 — do not include numerals in the generated passwords
  • --one-per-line, -1 — print one password per line
  • --symbols, -y — include at least one symbol in the password
  • --xkcd, -x — use multiple random english words combined into a password. By default, space is used as the separator and all words are lowercase 🌸
  • --xkcd-capitalize, --xkcdcapitalize, --xc — capitalize the first letter of each word in the generated xkcd style password. This flag implies -xkcd
  • --xkcd-lang, --lang, --xkcdlang, --xl — language to generate the password from; currently only en (english, default) or de are supported
  • --xkcd-numbers, --xkcdnumbers, --xn — add a random number to the end of the generated xkcd style password. This flag implies -xkcd
  • --xkcd-sep, --sep, --xkcdsep, --xs — word separator for the generated xkcd style password. If no separator is specified, the words are combined without spaces/separator and the first character of the words is capitalised. This flag implies -xkcd

rcs 🗃️

Run a RCS command inside a password store.

And the page says: if the password store is a git repository, execute a git command specified by git-command-args. Yeah, it says git — that's literally what the man page says, don't look at me 👀💀

recipients 👯‍♀️

Edit recipient permissions.

Displays all existing recipients for all mounted stores, and the subcommands let you add or remove recipients 💅

Flags

  • --json, -j — output recipients as JSON array
  • --pretty — pretty print recipients

reorg 🧹

Reorganize a password store by editing a text file.

This one lists all the secrets in a text file, line by line, and opens it in an editor. Once you save and leave the editor, gopass reads the temp file, calculates the necessary moves and shows you a diff and a confirmation prompt 🫶 Once you acknowledge, it reorganizes the secrets and creates a meaningful commit message. Iconic behavior, honestly ✨

secret-service 🔌

Run a D-Bus Secret Service daemon backed by gopass.

It implements the org.freedesktop.secrets D-Bus API so desktop applications (Firefox, Chromium, VS Code, Electron apps, NetworkManager, secret-tool, ...) store their secrets in the same gopass password store as the CLI 🎀 one store to rule them all, periodt

setup 🌟

Initialize a new password store.

This command is automatically invoked if gopass is started without any existing password store. It exists so users can be handed simple one-command setup instructions 💖

Flags

  • --create-team, --create — create a new team instead of joining an existing one (default: false, i.e. join an existing team)
  • --crypto — select the crypto backend [age, gpgcli, plain]
  • --email — EMail for unattended GPG key generation
  • --name — Firstname and Lastname for unattended GPG key generation
  • --remote — URL to a git remote, will attempt to join this team
  • --storage — select the storage backend [cryptfs, fossilfs, fs, gitfs, jjfs]
  • --team, --alias — name of the team to create or join (may contain slashes). Also used as the local mount point

show 👀

Display the content of a secret.

Shows an existing secret and optionally puts its first line on the clipboard. And if it does go on the clipboard — heads up — it gets cleared after 45 seconds ⏳ so go paste it, bestie 😭

Flags

  • --alsoclip, -C — copy the password and show everything
  • --chars — print specific characters from the secret
  • --nofuzzysearch — do not start fuzzy search when an entry is not found
  • --noparsing, -n — do not parse the output
  • --nosync — disable auto-sync
  • --password, -o — display only the password. Takes precedence over all other flags 👑
  • --qr — print the password as a QR Code
  • --qrbody — print the body as a QR Code
  • --revision, -r — show a past revision. Does NOT support RCS specific shortcuts. Use an exact revision or -<N> to select the Nth oldest revision of this entry
  • --safe, -s — do not display unsafe content (e.g. the password) even if safecontent is disabled
  • --unsafe, -u, -f — display unsafe content (e.g. the password) even if safecontent is enabled
  • --yes, -y — always answer yes to yes/no questions

sum 🧮

Compute the SHA256 checksum.

Decodes a Base64 encoded secret and computes the SHA256 checksum over the decoded data. Super useful for verifying the integrity of an inserted secret 🔥

sync 🔄

Sync all local stores with their remotes.

Syncs all local stores with their git remotes (if any) and checks any possibly affected gpg keys 🌈

Flags

  • --store, -s — select the store to sync

templates 🎀

Edit templates.

So yeah — it lists all the templates just vibing in your password store, and lets you edit them and create new ones. Templates are basically your little starter kits, and this is where you manage the whole lineup. 💅

🧹 unclip

An internal command to clear the clipboard. It clears the clipboard if the content matches the checksum — like a little bouncer checking IDs at the door. 🫶

Flags

  • --force — clear the clipboard even if the checksum mismatches. Yeah, it's a little pushy, but sometimes that's what you need.
  • --timeout — time to wait. ⏳

🔄 update

Check for updates, bestie.

This command checks for gopass updates over on GitHub and automatically downloads and installs any missing update for you. No manual labor, no hunting around — it just handles it. ✨

With --pre, release candidates and other pre-releases are considered as well — so if you like living on the edge, this is your moment. 🔥

Flags

  • --pre — include pre-releases (e.g. release candidates). It's giving early access, it's giving beta-tester main character energy. 👑

🌸 version

Display version.

This command displays version and build time information. Simple, iconic, does exactly what it says on the tin. 🎀

💖 REPORTING BUGS 💖

Found a bug? Don't suffer in silence, bestie — report it to <https://github.com/gopasspw/gopass/issues/new>. The maintainers literally want to know. 🐛✨

Copyright © 2021 Gopass Authors. This program is free software; you may redistribute it under the terms of the MIT license. This program has absolutely no warranty.

Translation: it's free, it's MIT-licensed, and if it breaks, nobody's legally on the hook. Standard open-source bestie behavior. 🫶

And that's the whole page, babes — this was gopass from gopass (github.com/gopasspw/go..., dated October 2026, filed under GOPASS(1). Go forth and store those secrets safely. 🦋💜🌸

📦 where this page comes from