impass(1)

💖 impass(1) — the slayest lil password manager 💖

okay bestie, come sit with me because impass is about to change your whole password situation, no cap. ✨

🌸 NAME 🌸

impass — a simple and secure password management and retrieval system 🎀 (yes, that's literally its whole thing and it ate)

---

🦋 SYNOPSIS 🦋

impass <command> [<args>...]

✨ DESCRIPTION ✨

so like, here's the vibe: your whole password database lives as one single json object, and it's OpenPGP encrypted and signed, then written to your local disk (peep IMPASS_DB for where). The file doesn't even exist until you add your first entry — it gets created right then, main character debut. 💅

Database entries are keyed by context. When you retrieve a password, the database gets decrypted and read into memory. Contexts are searched by sub-string match, so partial matches are very much a thing, iykyk.

Contexts can be literally any string. If you don't hand one over on the command line, it can be provided at a prompt — and that prompt has tab completion for contexts already chillin' in the database, which is iconic. You can also pass a context of - to read the context from stdin, or : to force a prompt. 🫶

Passwords are auto-generated by default with 18 bytes of entropy. Wanna change the number of octets? Use the IMPASS_PASSWORD environment variable or the optional pwspec argument on the relevant commands. Heads up though: the actual generated password will sometimes be longer than the bytes you specified, because of base64 encoding — that's just the encoding doing its thing, not a bug. 🙈 And if pwspec is :, the user gets prompted for the password. 💜

👑 COMMANDS 👑

• add [-h] [context] [pwspec] — adds a brand new entry. If that context is already in the database, you get an error. no duplicates allowed, we're exclusive. 🚫
• replace [-h] [context] [pwspec] — swaps out the password for an entry. If the context isn't already in the database, error. gotta exist first. 🫠
• update [-h] [old_context] [new_context] — updates the context for an existing entry and keeps the password exactly the same. The special context value of - can only be given to the old context. ⚠️
• dump [-h] [string] — dumps the password database to stdout as json. If you give it a string, only entries whose context contains that string get dumped; otherwise, everything comes out. Passwords will not be displayed unless IMPASS_DUMP_PASSWORDS is set. 🔒
• get [-h] [context] — prints the password matching the context to stdout. the classic. ✨
• gui [-h] [string] — launches a minimal GUI, which is good for X11 or Wayland-based window manager integration. On invocation you'll be prompted to decrypt the database, and after that a graphical search prompt shows up. If you gave an extra string, it gets added as the initial search string. All matching results for your query get presented to you, and when you select a result the password is retrieved according to the method specified by IMPASS_XPASTE. If there's no match, you get the opportunity to generate and store a new password, which is then delivered via IMPASS_XPASTE. 💅 Note: contexts with leading or trailing whitespace are not accessible through the GUI. 💀
• remove [-h] [context] — removes an entry. If the context isn't already in the database, error. bye bestie 👋
• help [-h] — full usage or command help (also just -h after a command). 🆘
• version [-h] — prints the version. 🌈

🔐 SIGNATURES 🔐

During decryption, OpenPGP signatures on the db file are checked for validity. If any of them are found to not be valid, a warning message gets written to stderr. So like, keep an eye on that, bestie. 👀

🌿 ENVIRONMENT 🌿

• IMPASS_DB — path to the impass database file. Default: ~/.impass/db 🗂️
• IMPASS_KEYFILE — file containing the OpenPGP key ID of the database encryption recipient. Default: ~/.impass/keyid 🔑
• IMPASS_KEYID — OpenPGP key ID of the database encryption recipient. This overrides IMPASS_KEYFILE if set. 👑
• IMPASS_PASSWORD — see Passwords above. 🥰
• IMPASS_DUMP_PASSWORDS — include passwords in the dump when set. 🙊
• IMPASS_XPASTE — method for password retrieval from the GUI. Options are: 'xdo', which attempts to type the password into the window that had focus on launch; 'xclip', which inserts the password in the X clipboard; and 'sway', which types the password into the focused wayland container. Default: xdo or sway, detected automatically. 🖥️

🫶 AUTHOR 🫶

Jameson Graef Rollins <jrollins@finestructure.net> and Daniel Kahn Gillmor <dkg@fifthhorseman.net>. thank u legends 😭💖

---

and that's the whole thing, bestie — impass, 19 February 2026, serving secure password realness. stay encrypted, stay iconic. 🎀✨💅