GOPASS(1) User Commands GOPASS(1) NAME gopass - The standard Unix password manager SYNOPSIS gopass [global options] command [command options] [,arguments...] GLOBAL OPTIONS --alsoclip, -C, Copy the password and show everything --chars, Print specific characters from the secret --clip, -c, Copy the password value into the clipboard --noparsing, -n, Do not parse the output. --nosync, Disable auto-sync --password, -o, Display only the password. Takes precedence over all other flags. --qr, Print the password as a QR Code --qrbody, Print the body as a QR Code --revision, -r, Show a past revision. Does NOT support RCS specific shortcuts. Use exact revision or -<N> to select the Nth oldest revision of this entry. --unsafe, -u, --force, -f, Display unsafe content (e.g. the password) even if safecontent is enabled --yes, -y, Always answer yes to yes/no questions COMMANDS age age commands Built-in commands for the age backend. These allow limited interactions with the gopass specific age identities. Added identities are automatically added as recipient to your secrets when encrypting, but not toyour recipients, make sure to keep your recipients and identities in sync as you want to. All age identities, including plu- gin ones should be supported. We also still support githubidentities de- spite them being deprecated by age, we do so by falling back to the ssh identitiesfor these and keeping a local cache of ssh keys for a given github identity. Flags --age-ssh-key-path, Custom path to SSH key or directory for age backend alias Print domain aliases Print defined domain aliases. audit Decrypt all secrets and scan for weak or leaked passwords This command decrypts all secrets and checks for common flaws and (option- ally) against a list of previously leaked passwords. Flags --format, Output format. text, csv or html. Default: text --full, Print full details of all findings. Default: false --output-file, -o, Output filename. Used for csv and html --summary, Print a summary of the audit results. Default: true (print summary) --template, HTML template. If not set use the built-in default. cat Decode and print content of a binary secret to stdout, or encode and insert from stdin This command is similar to the way cat works on the command line. It can either be used to retrieve the decoded content of a secret similar to 'cat file' or vice versa to encode the content from STDIN to a secret. clone Clone a password store from a git repository This command clones an existing password store from a git remote to a local password store. Can be either used to initialize a new root store or to add a new mounted sub-store. Needs at least one argument (git URL) to clone from. Accepts a second argument (mount location) to clone and mount a sub- store, e.g. 'gopass clone git@example.com/store.git foo/bar' Flags --check-keys, Check for valid decryption keys. Generate new keys if none are found. --crypto, Select crypto backend [age gpgcli plain] --path, Path to clone the repo to --storage, Select storage backend [cryptfs fossilfs gitfs jjfs] config Display and edit the configuration file This command allows for easy printing and editing of the configuration. Without argument, the entire config is printed. With a single argument, a single key can be printed. With two arguments a setting specified by key can be set to value. Flags --store, Set options to a specific store convert Convert a store to different backends Convert a store to a different set of backends Flags --crypto, Which crypto backend? [age gpgcli plain] --move, Replace store? --storage, Which storage backend? [cryptfs fossilfs fs gitfs jjfs] --store, Specify which store to convert copy Copy secrets from one location to another This command copies an existing secret in the store to another location. This also works across different sub-stores. If the source is a directory it will automatically copy recursively. In that case, the source directory is re-created at the destination if no trailing slash is found, otherwise the contents are flattened (similar to rsync). Flags --commit-message, -m, Set the commit message --force, -f, Force to copy the secret and overwrite existing one --interactive-commit, -i, Open an editor for the commit message create Easy creation of new secrets This command starts a wizard to aid in creation of new secrets. Flags --force, -f, Force path selection --store, -s, Which store to use delete Remove one or many secrets from the store This command removes secrets. It can work recursively on folders. Recursing across stores is purposefully not supported. Flags --commit-message, -m, Set the commit message --force, -f, Force to delete the secret --interactive-commit, -i, Open an editor for the commit message --recursive, -r, Recursive delete files and folders edit Edit new or existing secrets Use this command to insert a new secret or edit an existing one using your $EDITOR. It will attempt to create a secure temporary directory for storing your secret while the editor is accessing it. Please make sure your editor doesn't leak sensitive data to other locations while editing. Note: If $EDITOR is not set we will try 'editor'. If that's not available either we fall back to 'vi'. Consider using 'update-alternatives --config editor to change the defaults. Flags --commit-message, -m, Set the commit message --create, -c, Create a new secret if none found --editor, -e, Use this editor binary --interactive-commit, -i, Open an editor for the commit message env Run a subprocess with a pre-populated environment This command runs a sub process with the environment populated from the keys of a secret. Flags --keep-case, --kc, Do not capitalize the environment variable and instead retain the original capitalization find Search for secrets This command will first attempt a simple pattern match on the name of the secret. If there is an exact match it will be shown directly; if there are multiple matches, a selection will be shown. Flags --regex, -r, Interpret pattern as regular expression --unsafe, -u, --force, -f, In the case of an exact match, display the password even if safecontent is enabled fsck Check store integrity, clean up artifacts and possibly re-write secrets Check the integrity of the given sub-store or all stores if none are speci- fied. Will automatically fix all issues found, i.e. it will change permis- sions, re-write secrets and remove outdated configs. Flags --decrypt, Decrypt and reencrypt during fsck. --store, Limit fsck to this mount point fscopy Copy files from or to the password store This command either reads a file from the filesystem and writes the encoded and encrypted version in the store or it decrypts and decodes a secret and writes the result to a file. Either source or destination must be a file and the other one a secret. If you want the source to be securely removed after copying, use 'gopass binary move' fsmove Move files from or to the password store This command either reads a file from the filesystem and writes the encoded and encrypted version in the store or it decrypts and decodes a secret and writes the result to a file. Either source or destination must be a file and the other one a secret. The source will be wiped from disk or from the store after it has been copied successfully and validated. If you don't want the source to be removed use 'gopass binary copy' generate Generate a new password Dialog to generate a new password and write it into a new or existing se- cret. By default, the new password will replace the first line of an exist- ing secret (or create a new one). Flags --clip, -c, Copy the generated password to the clipboard --commit-message, -m, Set the commit message --edit, -e, Open secret for editing after generating a password --force, -f, Force to overwrite existing password --force-regen, -t, Force full re-generation, incl. evaluation of templates. Will overwrite the entire secret! --generator, -g, Choose a password generator, use one of: cryptic, memorable, xkcd or external. Default: cryptic --interactive-commit, -i, Open an editor for the commit message --lang, --xkcdlang, --xl, Language to generate password from, currently only en (english, default) or de are supported --print, -p, Print the generated password to the terminal --sep, --xkcdsep, --xs, Word separator for generated passwords. If no sepa- rator is specified, the words are combined without spaces/separator and the first character of words is capitalised. --strict, Require strict character class rules --symbols, -s, Use symbols in the password git Run a git command inside a password store: gopass git [--store=<store>] <git-command> If the password store is a git repository, execute a git command specified by git-command-args. Flags --store, Store to operate on grep Search for secrets files containing search-string when decrypted. This command decrypts all secrets and performs a pattern matching on the content. Flags --regexp, -r, Interpret pattern as RE2 regular expression history Show password history Display the change history for a secret Flags --password, -p, Include passwords in output init Initialize new password store. Initialize new password storage and use gpg-id for encryption. Flags --crypto, Select crypto backend [age gpgcli plain] --path, -p, Set the sub-store path to operate on --storage, Select storage backend [cryptfs fossilfs fs gitfs jjfs] --store, -s, Set the name of the sub-store insert Insert a new secret Insert a new secret. Optionally, echo the secret back to the console during entry. Or, optionally, the entry may be multiline. Prompt before overwrit- ing existing secret unless forced. Flags --append, -a, Append data read from STDIN to existing data --commit-message, Set the commit message --echo, -e, Display secret while typing --force, -f, Overwrite any existing secret and do not prompt to confirm re- cipients --interactive-commit, -i, Open an editor for the commit message --multiline, -m, Insert using $EDITOR link Create a symlink This command creates a symlink from one entry in a mounted store to another entry. Important: Does not cross mounts! list List existing secrets This command will list all existing secrets. Provide a folder prefix to list only certain subfolders of the store. Flags --flat, -f, Print a flat list --folders, -d, Print a flat list of folders --limit, -l, Display no more than this many levels of the tree --strip-prefix, -s, Strip this prefix from filtered entries merge Merge multiple secrets into one This command implements a merge workflow to help deduplicate secrets. It requires exactly one destination (may already exist) and at least one source (must exist, can be multiple). gopass will then merge all entries into one, drop into an editor, save the result and remove all merged en- tries. Flags --delete, -d, Remove merged entries --force, -f, Skip editor, merge entries unattended mounts Edit mounted stores This command displays all mounted password stores. It offers several sub- commands to create or remove mounts. move Move secrets from one location to another This command moves a secret from one path to another. This also works across different sub-stores. If the source is a directory, the source di- rectory is re-created at the destination if no trailing slash is found, otherwise the contents are flattened (similar to rsync). Flags --commit-message, -m, Set the commit message --force, -f, Force to move the secret and overwrite existing one --interactive-commit, -i, Open an editor for the commit message otp Generate time- or hmac-based tokens Tries to parse an OTP URL (otpauth://). URL can be TOTP or HOTP. The URL can be provided on its own line or on a key value line with a key named 'totp'. Flags --alsoclip, -C, Copy the time-based token and show it --chained, -p, chain the token to the password --clip, -c, Copy the time-based token into the clipboard --password, -o, Only display the token --qr, -q, Write QR code to FILE --snip, -s, Scan screen content to insert a OTP QR code into provided entry process Process a template file This command processes a template file. It will read the template file and replace all variables with their values. pwgen Generate passwords Print any number of password to the console. The optional length parameter specifies the length of each password. Flags --ambiguous, -B, Do not include characters that could be easily confused with each other, like '1' and 'l' or '0' and 'O' --lang, --xkcdlang, --xl, Language to generate password from, currently only en (english, default) or de are supported --no-capitalize, -A, Do not include capital letter in the generated passwords. --no-numerals, -0, Do not include numerals in the generated passwords. --one-per-line, -1, Print one password per line --sep, --xkcdsep, --xs, Word separator for generated xkcd style password. If no separator is specified, the words are combined without spaces/separator and the first character of words is capitalised. This flag implies -xkcd --symbols, -y, Include at least one symbol in the password. --xkcd, -x, Use multiple random english words combined to a password. By de- fault, space is used as separator and all words are lowercase --xkcdcapitalize, --xc, Capitalize first letter of each word in generated xkcd style password. This flag implies -xkcd --xkcdnumbers, --xn, Add a random number to the end of the generated xkcd style password. This flag implies -xkcd rcs Run a RCS command inside a password store If the password store is a git repository, execute a git command specified by git-command-args. recipients Edit recipient permissions This command displays all existing recipients for all mounted stores. The subcommands allow adding or removing recipients. Flags --pretty, Pretty print recipients reorg Reorganize a password store by editing a text file This command lists all the secrets in a text file, line by line, and then opens it in an editor. Once the user saves and leaves the editor, gopass will read the temp file, calculate the necessary moves and show a diff and a confirmation prompt. Once the user acknowledges that it will reorganize the secrets and create a meaningful commit message. setup Initialize a new password store This command is automatically invoked if gopass is started without any ex- isting password store. This command exists so users can be provided with simple one-command setup instructions. Flags --alias, Local mount point for the given remote --create, Create a new team (default: false, i.e. join an existing team) --crypto, Select crypto backend [age gpgcli plain] --email, EMail for unattended GPG key generation --name, Firstname and Lastname for unattended GPG key generation --remote, URL to a git remote, will attempt to join this team --storage, Select storage backend [cryptfs fossilfs fs gitfs jjfs] show Display the content of a secret Show an existing secret and optionally put its first line on the clipboard. If put on the clipboard, it will be cleared after 45 seconds. Flags --alsoclip, -C, Copy the password and show everything --chars, Print specific characters from the secret --clip, -c, Copy the password value into the clipboard --noparsing, -n, Do not parse the output. --nosync, Disable auto-sync --password, -o, Display only the password. Takes precedence over all other flags. --qr, Print the password as a QR Code --qrbody, Print the body as a QR Code --revision, -r, Show a past revision. Does NOT support RCS specific shortcuts. Use exact revision or -<N> to select the Nth oldest revision of this entry. --unsafe, -u, --force, -f, Display unsafe content (e.g. the password) even if safecontent is enabled --yes, -y, Always answer yes to yes/no questions sum Compute the SHA256 checksum This command decodes an Base64 encoded secret and computes the SHA256 checksum over the decoded data. This is useful to verify the integrity of an inserted secret. sync Sync all local stores with their remotes Sync all local stores with their git remotes, if any, and check any possi- bly affected gpg keys. Flags --store, -s, Select the store to sync templates Edit templates List existing templates in the password store and allow for editing and creating them. unclip Internal command to clear clipboard Clear the clipboard if the content matches the checksum. Flags --force, Clear clipboard even if checksum mismatches --timeout, Time to wait update Check for updates This command checks for gopass updates at GitHub and automatically down- loads and installs any missing update. version Display version This command displays version and build time information. REPORTING BUGS Report bugs to <https://github.com/gopasspw/gopass/issues/new> COPYRIGHT Copyright (C) 2021 Gopass Authors This program is free software; you may redistribute it under the terms of the MIT license. This program has ab- solutely no warranty. gopass (github.com/gopasspw/go... December 2025 GOPASS(1)
NAME | SYNOPSIS | GLOBAL OPTIONS | COMMANDS | REPORTING BUGS | COPYRIGHT
Want to link to this manual page? Use this URL:
<https://man.freebsd.org/cgi/man.cgi?query=gopass&sektion=1&manpath=FreeBSD+Ports+15.1.quarterly>