pass-tomb(1)

💖 pass-tomb(1) 💖

okay bestie, sit DOWN. this is pass-tomb, a pass(1) extension that keeps your ENTIRE password tree locked up inside a tomb(1). it lives in the General Commands Manual, section 1, and it's giving main character energy fr fr 💅

---

✨ NAME ✨

pass-tomb — a pass(1) extension that helps to keep the whole tree of password encrypted inside a tomb(1). 🎀

---

✨ SYNOPSIS ✨

pass tomb [args] gpgid...
pass open  [args]
pass close [args]

---

✨ DESCRIPTION ✨

so here's the tea, bestie: the way pass(1) is built, your file names and directory names are not encrypted in the password store. like, the contents are safe but the names are just out there, visible. 😭

pass tomb is the convenient glow-up solution: it puts your password store inside a tomb(1), so your whole password tree stays encrypted whenever you're not actively using it. obsessed. 💖

it uses the same GPG key to encrypt passwords and the tomb, so you don't have to manage any extra key or secret. no cap. and even better — you can ask pass-tomb to automatically close your store after a given time. iconic behavior. ✨

the new workflow is literally this:

1. Create a password tomb with pass tomb. It creates a new tomb and opens it in ~/.password-store. Then it initialises the password repository with the same GPG key.
2. Use tomb as usual.
3. When finished close the password tomb: pass close.
4. To use pass again, you need to open the password tomb: pass open.

---

🌸 COMMAND 🌸

pass tomb [ --no-init, -n ] [--timer=time, -t time]
          [ --path=subfolder, -p subfolder ] [--force, -f] gpg-id...

• pass tomb — Create and initialise a new password tomb. this is the first thing you have to run, before a password store can be used at all. periodt.

use gpg-id for encryption of both passwords and tomb. Multiple gpg-ids may be specified, in order to encrypt the tomb and each password with multiple ids. so like, stack those ids if that's your vibe. 💅

If --path or -p is specified, along with an argument, a specific password tomb using gpg-id or a set of gpg-ids is assigned for that specific subfolder of the password store.

If --no-init, -n is specified, do not initialise the password store. By default, pass-tomb initialises the password store with the same key(s) it generated the tomb. The purpose of this option is to let the user free to initialise the password store with a different key or set of keys. 🦋

If --timer, -t is specified, along with an argument, the password store will be automatically closed using a systemd timer after a given time. This time will be saved in the .timer file present in the store. ⏰

If --force is specified, the password store will create or mount the password store even if a plain text swap is present.

⚠️ Make sure you know what you are doing if you force an operation. seriously bestie, know what you're doing. 😭

---

🌈 pass open

pass open [--timer=time, -t time] [--force, -f] [subfolder]

Open a password tomb. If a .timer file is present in the store, a systemd timer will be initialized.

If --timer, -t is specified, along with an argument, the password store will be automatically closed using a systemd timer after a given time. If a '.time' file was already present in the store, this time will be updated. Multiple timer can be used in the same time.

If --force is specified, the password store will create or mount the password store even if a plain text swap is present.

⚠️ Make sure you know what you are doing if you force an operation. (yes, again. it's that serious. 💀)

If subfolder is specified, the password store will be opened in the subfolder.

---

🌈 pass close

pass close [store]

Close a password tomb.

If store is specified, pass close will try to close this store.

---

🌈 pass timer

pass timer [store]

Show timer status.

If store is specified, pass timer will show the status for this store.

---

🎀 OPTIONS 🎀

• -n, --no-init — Do not initialise the password store
• -t, --timer — Close the store after a given time
• -p, --path — Create the store for that specific subfolder
• -f, --force — Force the tomb operations (i.e. even if swap is active)
• -q, --quiet — Be quiet 🤫
• -v, --verbose — Be verbose (tell me EVERYTHING)
• -d, --debug — Print tomb debug messages
• --unsafe — Speed up tomb creation (for testing purposes only)

🚨 testing purposes ONLY, bestie. don't be out here using this in real life.

• -V, --version — Show version information
• -h, --help — Show usage message

---

⭐ EXAMPLES ⭐

Create a new password tomb

zx2c4@laptop ~ $ pass tomb Jason@zx2c4.com
 (*) Your password tomb has been created and opened in
~/.password-store.
 (*) Password store initialised for Jason@zx2c4.com.
  .  Your tomb is: ~/.password.tomb
  .  Your tomb key is: ~/.password.key.tomb
  .  You can now use pass as usual.
  .  When finished, close the password tomb using 'pass close'.

Open a password tomb

zx2c4@laptop ~ $ pass open
 (*) Your password tomb has been opened in ~/.password-store.
  .  You can now use pass as usual.
  .  When finished, close the password tomb using 'pass close'.

Close a password tomb

zx2c4@laptop ~ $ pass close
 (*) Your password tomb has been closed.
  .  Your passwords remain present in ~/.password.tomb.

Create a new password tomb and set a timer

zx2c4@laptop ~ $ pass tomb Jason@zx2c4.com --timer=1h
 (*) Your password tomb has been created and opened in
~/.password-store.
 (*) Password store initialised for Jason@zx2c4.com.
  .  Your tomb is: ~/.password.tomb
  .  Your tomb key is: ~/.password.key.tomb
  .  You can now use pass as usual.
  .  This password store will be closed in 1h
zx2c4@laptop ~ $ pass open
 (*) Your password tomb has been opened in ~/.password-store.
  .  You can now use pass as usual.
  .  This password store will be closed in 1h

Open a password tomb and set a timer

zx2c4@laptop ~ $ pass open
 (*) Your password tomb has been opened in ~/.password-store.
  .  You can now use pass as usual.
  .  This password store will be closed in 10min

---

🦋 ENVIRONMENT VARIABLES 🦋

• PASSWORD_STORE_TOMB — Path to tomb executable
• PASSWORD_STORE_TOMB_FILE — Path to the password tomb, by default ~/.password.tomb
• PASSWORD_STORE_TOMB_KEY — Path to the password tomb key file by default ~/.password.key.tomb
• PASSWORD_STORE_TOMB_SIZE — Password tomb size in MB, by default 10

---

💜 SEE ALSO 💜

pass(1), tomb(1), pass-import(1), pass-update(1), pass-audit(1), pass-otp(1)

---

👑 AUTHORS 👑

pass tomb was written by Alexandre Pujol. shoutout king 🫶

---

📜 COPYING 📜

This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program. If not, see <http://www.gnu.org/licenses/>.

---

and that's the whole page bestie 💖 this was pass-tomb, from the pass-tomb manual (section 1, obviously), dated May 2021. slay, stay encrypted, close your tomb when you're done. mwah 💅✨🎀