{"slug": "pass", "name": "pass", "category": "security", "category_name": "Security and passwords", "description": "Unix command-line password manager storing GPG-encrypted files in a git repository.", "recommenders": 6, "commenters": 9, "warners": 0, "score": 6.266, "rising": 0.69, "first": "2025-11-28", "latest": "2026-10-10", "why": "Liked for keeping GPG-encrypted passwords as plain files in a git repo you can sync however you want, plus hardware-key support and years of reliable use.", "why_is_quote": false, "has_verdict": true, "sentiment": {"recommend": 6, "neutral": 3, "compare": 0, "warn": 0}, "spark": [1, 0, 0, 0, 0, 0, 3, 0, 0, 0, 2, 0], "listed": true, "loved": ["Git-based sync", "Hardware keys"], "caveat": "GPG dependency", "short_quote": "I have been using https://www.passwordstore.org/ for 10 years and am super happy with it.", "icon": false, "domain": "passwordstore.org", "github_repo": null, "official_url": "https://www.passwordstore.org/", "pricing": "open source", "aliases": ["pass"], "verdict": [{"text": "Liked for keeping GPG-encrypted passwords as plain files in a git repo you can sync however you want", "cites": [{"id": 771588384, "item_id": 48224274, "url": "https://news.ycombinator.com/item?id=48224274", "by": "cjs_ac", "date": "2026-05-21", "stance": "recommend", "quote": "I store my passwords using this: https://www.passwordstore.org/", "excerpt": "I store my passwords using this: https://www.passwordstore.org/ It's a shell script that stores passwords in a git repository, containing one file per entry. The files are encrypted using a GPG key. Because it's just a git repository, you can synchronise it between devices using whatever infrastructure you want. I use a FOSS client for it on iOS, and there was one for Android before I got an iPhone.", "context": "", "use_case": "password storage synced via git", "switched_from": "", "story": "Get your passwords out of Bitwarden while you still can"}, {"id": 770971408, "item_id": 48185713, "url": "https://news.ycombinator.com/item?id=48185713", "by": "worksonmine", "date": "2026-05-18", "stance": "recommend", "quote": "I use pass[1] and it is good.", "excerpt": "How portable do you need it to be? I use pass[1] and it is good. Just a shell script wrapper to gpg and the passwords are encrypted files you can backup and sync anyway you want. [1]: https://www.passwordstore.org/", "context": "", "use_case": "password management", "switched_from": "", "story": "The Quiet Renovation at Bitwarden"}, {"id": 767843408, "item_id": 47990213, "url": "https://news.ycombinator.com/item?id=47990213", "by": "cjs_ac", "date": "2026-05-02", "stance": "recommend", "quote": "I use pass[0], and it works well for me. It's secured by PGP and passwords are shared between devices using git.", "excerpt": "I use pass[0], and it works well for me. It's secured by PGP and passwords are shared between devices using git. [0] https://www.passwordstore.org/", "context": "", "use_case": "password management", "switched_from": "", "story": "I Do Not Recommend Bitwarden"}]}, {"text": ", plus hardware-key support and years of reliable use.", "cites": [{"id": 792746320, "item_id": 49546645, "url": "https://news.ycombinator.com/item?id=49546645", "by": "gspr", "date": "2026-09-03", "stance": "recommend", "quote": "I highly recommend https://www.passwordstore.org/ coupled with a PGP key storage dongle", "excerpt": "Are people in your company moderately technical? If so, I highly recommend https://www.passwordstore.org/ coupled with a PGP key storage dongle (I personally use NitroKey). Then hosting is just a matter of hosting a minuscule git repo per user. I imagine that a technical company can easily whip up a bespoke simplified interface for its non-technical staff too. I've used it for about a decade at this point, and it's j", "context": "has used it for about a decade", "use_case": "company password management", "switched_from": "", "story": "Ask HN: Advice on Migrating from 1Password?"}, {"id": 737242673, "item_id": 46077667, "url": "https://news.ycombinator.com/item?id=46077667", "by": "sakisv", "date": "2025-11-28", "stance": "recommend", "quote": "The way I solve the plain text problem is through a combination of direnv[1] and pass[2].", "excerpt": "The way I solve the plain text problem is through a combination of direnv[1] and pass[2]. For a given project, I have a `./creds` directory which is managed with pass and it contains all the access tokens and api keys that are relevant for that project, one per file, for example, `./creds/cloudflare/api_token`. Pass encrypts all these files via gpg, for which I use a key stored on a Yubikey. Next to the `./creds` dir", "context": "", "use_case": "encrypted API tokens storage", "switched_from": "", "story": "GitLab discovers widespread NPM supply chain attack"}, {"id": 792761040, "item_id": 49547565, "url": "https://news.ycombinator.com/item?id=49547565", "by": "ngrislain", "date": "2026-09-03", "stance": "recommend", "quote": "I have been using https://www.passwordstore.org/ for 10 years and am super happy with it.", "excerpt": "I have been using https://www.passwordstore.org/ for 10 years and am super happy with it. It does not provide all the convenient integrations of 1Password though.", "context": "", "use_case": "password management", "switched_from": "", "story": "Ask HN: Advice on Migrating from 1Password?"}]}, {"text": " Caveats include its dependency on GPG, which one commenter calls a hassle to operate", "cites": [{"id": 771603632, "item_id": 48225227, "url": "https://news.ycombinator.com/item?id=48225227", "by": "wfleming", "date": "2026-05-21", "stance": "recommend", "quote": "Pass has a pretty good ecosystem of plugins/other clients, as well.", "excerpt": "I also use pass. Any forge you feel like is fine (I use gitlab). I backup my gpg key with `gpg \u2014export-owner-trust` and store that backup elsewhere. Pass has a pretty good ecosystem of plugins/other clients, as well. There are open source iOS/Android clients and browser extensions so once you\u2019re setup the day-to-day experience is not far off from any of the popular hosted password managers. My only real issue is the ", "context": "", "use_case": "password management", "switched_from": "", "story": "Get your passwords out of Bitwarden while you still can"}]}, {"text": ", fewer integrations than 1Password, and edits from two clients not merging cleanly without manual work.", "cites": [{"id": 792761040, "item_id": 49547565, "url": "https://news.ycombinator.com/item?id=49547565", "by": "ngrislain", "date": "2026-09-03", "stance": "recommend", "quote": "I have been using https://www.passwordstore.org/ for 10 years and am super happy with it.", "excerpt": "I have been using https://www.passwordstore.org/ for 10 years and am super happy with it. It does not provide all the convenient integrations of 1Password though.", "context": "", "use_case": "password management", "switched_from": "", "story": "Ask HN: Advice on Migrating from 1Password?"}, {"id": 800554769, "item_id": 50034673, "url": "https://news.ycombinator.com/item?id=50034673", "by": "philsnow", "date": "2026-10-10", "stance": "neutral", "quote": "I used to use gnupass and its variants (including passforios on mobile)", "excerpt": "I used to use gnupass and its variants (including passforios on mobile), but what brought me to bitwarden was being able to make changes on two clients and merge the results cleanly / usefully without needing to do anything manually at all. How does this work with keepassxc? Does it depend on your file syncing primitive?", "context": "", "use_case": "password manager", "switched_from": "", "story": "Bitwarden Dual License Model"}]}], "praise": [{"label": "Git-based sync", "summary": "Passwords are encrypted files in a git repo, synced with any infrastructure you choose.", "quotes": [{"id": 771588384, "item_id": 48224274, "url": "https://news.ycombinator.com/item?id=48224274", "by": "cjs_ac", "date": "2026-05-21", "stance": "recommend", "quote": "I store my passwords using this: https://www.passwordstore.org/", "excerpt": "I store my passwords using this: https://www.passwordstore.org/ It's a shell script that stores passwords in a git repository, containing one file per entry. The files are encrypted using a GPG key. Because it's just a git repository, you can synchronise it between devices using whatever infrastructure you want. I use a FOSS client for it on iOS, and there was one for Android before I got an iPhone.", "context": "", "use_case": "password storage synced via git", "switched_from": "", "story": "Get your passwords out of Bitwarden while you still can"}, {"id": 770971408, "item_id": 48185713, "url": "https://news.ycombinator.com/item?id=48185713", "by": "worksonmine", "date": "2026-05-18", "stance": "recommend", "quote": "I use pass[1] and it is good.", "excerpt": "How portable do you need it to be? I use pass[1] and it is good. Just a shell script wrapper to gpg and the passwords are encrypted files you can backup and sync anyway you want. [1]: https://www.passwordstore.org/", "context": "", "use_case": "password management", "switched_from": "", "story": "The Quiet Renovation at Bitwarden"}, {"id": 767843408, "item_id": 47990213, "url": "https://news.ycombinator.com/item?id=47990213", "by": "cjs_ac", "date": "2026-05-02", "stance": "recommend", "quote": "I use pass[0], and it works well for me. It's secured by PGP and passwords are shared between devices using git.", "excerpt": "I use pass[0], and it works well for me. It's secured by PGP and passwords are shared between devices using git. [0] https://www.passwordstore.org/", "context": "", "use_case": "password management", "switched_from": "", "story": "I Do Not Recommend Bitwarden"}]}, {"label": "Hardware keys", "summary": "Works with GPG keys on YubiKey or NitroKey dongles.", "quotes": [{"id": 792746320, "item_id": 49546645, "url": "https://news.ycombinator.com/item?id=49546645", "by": "gspr", "date": "2026-09-03", "stance": "recommend", "quote": "I highly recommend https://www.passwordstore.org/ coupled with a PGP key storage dongle", "excerpt": "Are people in your company moderately technical? If so, I highly recommend https://www.passwordstore.org/ coupled with a PGP key storage dongle (I personally use NitroKey). Then hosting is just a matter of hosting a minuscule git repo per user. I imagine that a technical company can easily whip up a bespoke simplified interface for its non-technical staff too. I've used it for about a decade at this point, and it's j", "context": "has used it for about a decade", "use_case": "company password management", "switched_from": "", "story": "Ask HN: Advice on Migrating from 1Password?"}, {"id": 737242673, "item_id": 46077667, "url": "https://news.ycombinator.com/item?id=46077667", "by": "sakisv", "date": "2025-11-28", "stance": "recommend", "quote": "The way I solve the plain text problem is through a combination of direnv[1] and pass[2].", "excerpt": "The way I solve the plain text problem is through a combination of direnv[1] and pass[2]. For a given project, I have a `./creds` directory which is managed with pass and it contains all the access tokens and api keys that are relevant for that project, one per file, for example, `./creds/cloudflare/api_token`. Pass encrypts all these files via gpg, for which I use a key stored on a Yubikey. Next to the `./creds` dir", "context": "", "use_case": "encrypted API tokens storage", "switched_from": "", "story": "GitLab discovers widespread NPM supply chain attack"}, {"id": 780878321, "item_id": 48804895, "url": "https://news.ycombinator.com/item?id=48804895", "by": "floathub", "date": "2026-07-06", "stance": "neutral", "quote": "We use YubiKeys on desktops/laptops with pass/password-store", "excerpt": "Hi HN. We use YubiKeys on desktops/laptops with pass/password-store, and have been fiddling with various ways to get them to work on our phones and tablets for a long time. Sort of dawned on us that since the Apple secure enclave gives the same sort of \"non-extractable\" protection as a YubiKey does, we could just use that. Paired with touch/face-id, seems like a pretty good YubiKey alternative for a mobile app. Since", "context": "", "use_case": "password management", "switched_from": "", "story": "Show HN: Using the secure enclave in a pass/password-store iOS client"}]}, {"label": "Long-term reliability", "summary": "Commenters report about a decade of happy use.", "quotes": [{"id": 792761040, "item_id": 49547565, "url": "https://news.ycombinator.com/item?id=49547565", "by": "ngrislain", "date": "2026-09-03", "stance": "recommend", "quote": "I have been using https://www.passwordstore.org/ for 10 years and am super happy with it.", "excerpt": "I have been using https://www.passwordstore.org/ for 10 years and am super happy with it. It does not provide all the convenient integrations of 1Password though.", "context": "", "use_case": "password management", "switched_from": "", "story": "Ask HN: Advice on Migrating from 1Password?"}, {"id": 792746320, "item_id": 49546645, "url": "https://news.ycombinator.com/item?id=49546645", "by": "gspr", "date": "2026-09-03", "stance": "recommend", "quote": "I highly recommend https://www.passwordstore.org/ coupled with a PGP key storage dongle", "excerpt": "Are people in your company moderately technical? If so, I highly recommend https://www.passwordstore.org/ coupled with a PGP key storage dongle (I personally use NitroKey). Then hosting is just a matter of hosting a minuscule git repo per user. I imagine that a technical company can easily whip up a bespoke simplified interface for its non-technical staff too. I've used it for about a decade at this point, and it's j", "context": "has used it for about a decade", "use_case": "company password management", "switched_from": "", "story": "Ask HN: Advice on Migrating from 1Password?"}]}, {"label": "Developer secrets", "summary": "Pairs with direnv or .env files to load API tokens without plain-text storage.", "quotes": [{"id": 737242673, "item_id": 46077667, "url": "https://news.ycombinator.com/item?id=46077667", "by": "sakisv", "date": "2025-11-28", "stance": "recommend", "quote": "The way I solve the plain text problem is through a combination of direnv[1] and pass[2].", "excerpt": "The way I solve the plain text problem is through a combination of direnv[1] and pass[2]. For a given project, I have a `./creds` directory which is managed with pass and it contains all the access tokens and api keys that are relevant for that project, one per file, for example, `./creds/cloudflare/api_token`. Pass encrypts all these files via gpg, for which I use a key stored on a Yubikey. Next to the `./creds` dir", "context": "", "use_case": "encrypted API tokens storage", "switched_from": "", "story": "GitLab discovers widespread NPM supply chain attack"}, {"id": 747488337, "item_id": 46718021, "url": "https://news.ycombinator.com/item?id=46718021", "by": "ReluctantLaser", "date": "2026-01-22", "stance": "neutral", "quote": "MY_SECRET=$(pass show path/to/my/secret)", "excerpt": "I feel I see these solutions somewhat often, but you can execute a command and use that as a value. To me, I'm not sure why people aren't calling their secret store as part of it. I use direnv mostly, but seems `.env` supports the same thing. e.g: MY_SECRET=$(pass show path/to/my/secret) Of course substitute that for Vault/SSM/whatever. There are other solutions to this problem too, but I show this to people as there", "context": "", "use_case": "secret store for env values", "switched_from": "", "story": "Show HN: Dotenv Mask Editor: No more embarrassing screen leaks of your .env"}]}, {"label": "Client ecosystem", "summary": "Open source iOS/Android clients, browser extensions and plugins make daily use close to hosted managers.", "quotes": [{"id": 771603632, "item_id": 48225227, "url": "https://news.ycombinator.com/item?id=48225227", "by": "wfleming", "date": "2026-05-21", "stance": "recommend", "quote": "Pass has a pretty good ecosystem of plugins/other clients, as well.", "excerpt": "I also use pass. Any forge you feel like is fine (I use gitlab). I backup my gpg key with `gpg \u2014export-owner-trust` and store that backup elsewhere. Pass has a pretty good ecosystem of plugins/other clients, as well. There are open source iOS/Android clients and browser extensions so once you\u2019re setup the day-to-day experience is not far off from any of the popular hosted password managers. My only real issue is the ", "context": "", "use_case": "password management", "switched_from": "", "story": "Get your passwords out of Bitwarden while you still can"}, {"id": 771588384, "item_id": 48224274, "url": "https://news.ycombinator.com/item?id=48224274", "by": "cjs_ac", "date": "2026-05-21", "stance": "recommend", "quote": "I store my passwords using this: https://www.passwordstore.org/", "excerpt": "I store my passwords using this: https://www.passwordstore.org/ It's a shell script that stores passwords in a git repository, containing one file per entry. The files are encrypted using a GPG key. Because it's just a git repository, you can synchronise it between devices using whatever infrastructure you want. I use a FOSS client for it on iOS, and there was one for Android before I got an iPhone.", "context": "", "use_case": "password storage synced via git", "switched_from": "", "story": "Get your passwords out of Bitwarden while you still can"}]}], "caveats": [{"label": "GPG dependency", "summary": "GPG is described as dated and a hassle to operate, and worth learning before committing.", "quotes": [{"id": 771603632, "item_id": 48225227, "url": "https://news.ycombinator.com/item?id=48225227", "by": "wfleming", "date": "2026-05-21", "stance": "recommend", "quote": "Pass has a pretty good ecosystem of plugins/other clients, as well.", "excerpt": "I also use pass. Any forge you feel like is fine (I use gitlab). I backup my gpg key with `gpg \u2014export-owner-trust` and store that backup elsewhere. Pass has a pretty good ecosystem of plugins/other clients, as well. There are open source iOS/Android clients and browser extensions so once you\u2019re setup the day-to-day experience is not far off from any of the popular hosted password managers. My only real issue is the ", "context": "", "use_case": "password management", "switched_from": "", "story": "Get your passwords out of Bitwarden while you still can"}]}, {"label": "Fewer integrations", "summary": "Lacks the convenient integrations of 1Password.", "quotes": [{"id": 792761040, "item_id": 49547565, "url": "https://news.ycombinator.com/item?id=49547565", "by": "ngrislain", "date": "2026-09-03", "stance": "recommend", "quote": "I have been using https://www.passwordstore.org/ for 10 years and am super happy with it.", "excerpt": "I have been using https://www.passwordstore.org/ for 10 years and am super happy with it. It does not provide all the convenient integrations of 1Password though.", "context": "", "use_case": "password management", "switched_from": "", "story": "Ask HN: Advice on Migrating from 1Password?"}]}, {"label": "Multi-client merging", "summary": "A former user switched to Bitwarden for clean automatic merging of changes from two clients.", "quotes": [{"id": 800554769, "item_id": 50034673, "url": "https://news.ycombinator.com/item?id=50034673", "by": "philsnow", "date": "2026-10-10", "stance": "neutral", "quote": "I used to use gnupass and its variants (including passforios on mobile)", "excerpt": "I used to use gnupass and its variants (including passforios on mobile), but what brought me to bitwarden was being able to make changes on two clients and merge the results cleanly / usefully without needing to do anything manually at all. How does this work with keepassxc? Does it depend on your file syncing primitive?", "context": "", "use_case": "password manager", "switched_from": "", "story": "Bitwarden Dual License Model"}]}, {"label": "Mobile hardware keys", "summary": "Getting YubiKey-backed pass working on phones and tablets took long fiddling for one team.", "quotes": [{"id": 780878321, "item_id": 48804895, "url": "https://news.ycombinator.com/item?id=48804895", "by": "floathub", "date": "2026-07-06", "stance": "neutral", "quote": "We use YubiKeys on desktops/laptops with pass/password-store", "excerpt": "Hi HN. We use YubiKeys on desktops/laptops with pass/password-store, and have been fiddling with various ways to get them to work on our phones and tablets for a long time. Sort of dawned on us that since the Apple secure enclave gives the same sort of \"non-extractable\" protection as a YubiKey does, we could just use that. Paired with touch/face-id, seems like a pretty good YubiKey alternative for a mobile app. Since", "context": "", "use_case": "password management", "switched_from": "", "story": "Show HN: Using the secure enclave in a pass/password-store iOS client"}]}], "who": [{"by": "gspr", "context": "has used it for about a decade", "url": "https://news.ycombinator.com/item?id=49546645", "date": "2026-09-03"}], "tags": ["for developers", "for technical teams", "self-hostable", "for YubiKey users", "for command-line users"], "use_cases": ["password management", "password manager", "company password management", "password storage synced via git", "secret store for env values", "encrypted api tokens storage"], "compared": [{"slug": "bitwarden", "name": "Bitwarden", "co": 4, "switched_from": 0, "switched_to": 1}, {"slug": "gnupg", "name": "GnuPG", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "1password", "name": "1Password", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "direnv", "name": "direnv", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=49546432", "title": "Ask HN: Advice on Migrating from 1Password?", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=48223258", "title": "Get your passwords out of Bitwarden while you still can", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=50033407", "title": "Bitwarden Dual License Model", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48804894", "title": "Show HN: Using the secure enclave in a pass/password-store iOS client", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48163389", "title": "The Quiet Renovation at Bitwarden", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47989931", "title": "I Do Not Recommend Bitwarden", "mentions": 1}], "sentiment_by_month": {"2025-11": {"recommend": 1}, "2025-12": {}, "2026-01": {"neutral": 1}, "2026-02": {}, "2026-03": {}, "2026-04": {}, "2026-05": {"recommend": 3}, "2026-06": {}, "2026-07": {"neutral": 1}, "2026-08": {}, "2026-09": {"recommend": 2}, "2026-10": {"neutral": 1}}, "quotes": [{"id": 800554769, "item_id": 50034673, "url": "https://news.ycombinator.com/item?id=50034673", "by": "philsnow", "date": "2026-10-10", "stance": "neutral", "quote": "I used to use gnupass and its variants (including passforios on mobile)", "excerpt": "I used to use gnupass and its variants (including passforios on mobile), but what brought me to bitwarden was being able to make changes on two clients and merge the results cleanly / usefully without needing to do anything manually at all. How does this work with keepassxc? Does it depend on your file syncing primitive?", "context": "", "use_case": "password manager", "switched_from": "", "story": "Bitwarden Dual License Model"}, {"id": 792761040, "item_id": 49547565, "url": "https://news.ycombinator.com/item?id=49547565", "by": "ngrislain", "date": "2026-09-03", "stance": "recommend", "quote": "I have been using https://www.passwordstore.org/ for 10 years and am super happy with it.", "excerpt": "I have been using https://www.passwordstore.org/ for 10 years and am super happy with it. It does not provide all the convenient integrations of 1Password though.", "context": "", "use_case": "password management", "switched_from": "", "story": "Ask HN: Advice on Migrating from 1Password?"}, {"id": 792746320, "item_id": 49546645, "url": "https://news.ycombinator.com/item?id=49546645", "by": "gspr", "date": "2026-09-03", "stance": "recommend", "quote": "I highly recommend https://www.passwordstore.org/ coupled with a PGP key storage dongle", "excerpt": "Are people in your company moderately technical? If so, I highly recommend https://www.passwordstore.org/ coupled with a PGP key storage dongle (I personally use NitroKey). Then hosting is just a matter of hosting a minuscule git repo per user. I imagine that a technical company can easily whip up a bespoke simplified interface for its non-technical staff too. I've used it for about a decade at this point, and it's j", "context": "has used it for about a decade", "use_case": "company password management", "switched_from": "", "story": "Ask HN: Advice on Migrating from 1Password?"}, {"id": 780878321, "item_id": 48804895, "url": "https://news.ycombinator.com/item?id=48804895", "by": "floathub", "date": "2026-07-06", "stance": "neutral", "quote": "We use YubiKeys on desktops/laptops with pass/password-store", "excerpt": "Hi HN. We use YubiKeys on desktops/laptops with pass/password-store, and have been fiddling with various ways to get them to work on our phones and tablets for a long time. Sort of dawned on us that since the Apple secure enclave gives the same sort of \"non-extractable\" protection as a YubiKey does, we could just use that. Paired with touch/face-id, seems like a pretty good YubiKey alternative for a mobile app. Since", "context": "", "use_case": "password management", "switched_from": "", "story": "Show HN: Using the secure enclave in a pass/password-store iOS client"}, {"id": 771603632, "item_id": 48225227, "url": "https://news.ycombinator.com/item?id=48225227", "by": "wfleming", "date": "2026-05-21", "stance": "recommend", "quote": "Pass has a pretty good ecosystem of plugins/other clients, as well.", "excerpt": "I also use pass. Any forge you feel like is fine (I use gitlab). I backup my gpg key with `gpg \u2014export-owner-trust` and store that backup elsewhere. Pass has a pretty good ecosystem of plugins/other clients, as well. There are open source iOS/Android clients and browser extensions so once you\u2019re setup the day-to-day experience is not far off from any of the popular hosted password managers. My only real issue is the ", "context": "", "use_case": "password management", "switched_from": "", "story": "Get your passwords out of Bitwarden while you still can"}, {"id": 771588384, "item_id": 48224274, "url": "https://news.ycombinator.com/item?id=48224274", "by": "cjs_ac", "date": "2026-05-21", "stance": "recommend", "quote": "I store my passwords using this: https://www.passwordstore.org/", "excerpt": "I store my passwords using this: https://www.passwordstore.org/ It's a shell script that stores passwords in a git repository, containing one file per entry. The files are encrypted using a GPG key. Because it's just a git repository, you can synchronise it between devices using whatever infrastructure you want. I use a FOSS client for it on iOS, and there was one for Android before I got an iPhone.", "context": "", "use_case": "password storage synced via git", "switched_from": "", "story": "Get your passwords out of Bitwarden while you still can"}, {"id": 770971408, "item_id": 48185713, "url": "https://news.ycombinator.com/item?id=48185713", "by": "worksonmine", "date": "2026-05-18", "stance": "recommend", "quote": "I use pass[1] and it is good.", "excerpt": "How portable do you need it to be? I use pass[1] and it is good. Just a shell script wrapper to gpg and the passwords are encrypted files you can backup and sync anyway you want. [1]: https://www.passwordstore.org/", "context": "", "use_case": "password management", "switched_from": "", "story": "The Quiet Renovation at Bitwarden"}, {"id": 767843408, "item_id": 47990213, "url": "https://news.ycombinator.com/item?id=47990213", "by": "cjs_ac", "date": "2026-05-02", "stance": "recommend", "quote": "I use pass[0], and it works well for me. It's secured by PGP and passwords are shared between devices using git.", "excerpt": "I use pass[0], and it works well for me. It's secured by PGP and passwords are shared between devices using git. [0] https://www.passwordstore.org/", "context": "", "use_case": "password management", "switched_from": "", "story": "I Do Not Recommend Bitwarden"}, {"id": 747488337, "item_id": 46718021, "url": "https://news.ycombinator.com/item?id=46718021", "by": "ReluctantLaser", "date": "2026-01-22", "stance": "neutral", "quote": "MY_SECRET=$(pass show path/to/my/secret)", "excerpt": "I feel I see these solutions somewhat often, but you can execute a command and use that as a value. To me, I'm not sure why people aren't calling their secret store as part of it. I use direnv mostly, but seems `.env` supports the same thing. e.g: MY_SECRET=$(pass show path/to/my/secret) Of course substitute that for Vault/SSM/whatever. There are other solutions to this problem too, but I show this to people as there", "context": "", "use_case": "secret store for env values", "switched_from": "", "story": "Show HN: Dotenv Mask Editor: No more embarrassing screen leaks of your .env"}, {"id": 737242673, "item_id": 46077667, "url": "https://news.ycombinator.com/item?id=46077667", "by": "sakisv", "date": "2025-11-28", "stance": "recommend", "quote": "The way I solve the plain text problem is through a combination of direnv[1] and pass[2].", "excerpt": "The way I solve the plain text problem is through a combination of direnv[1] and pass[2]. For a given project, I have a `./creds` directory which is managed with pass and it contains all the access tokens and api keys that are relevant for that project, one per file, for example, `./creds/cloudflare/api_token`. Pass encrypts all these files via gpg, for which I use a key stored on a Yubikey. Next to the `./creds` dir", "context": "", "use_case": "encrypted API tokens storage", "switched_from": "", "story": "GitLab discovers widespread NPM supply chain attack"}]}