MyPass — a password manager
mypass keeps your passwords in a single encrypted file (~/mypass.scrypt by
default). All cryptography happens in-process; there are no runtime
dependencies on external programs.
Other variants
There is also a native Android app
Installation
cargo install --path .
Quick start
mypass init # create an empty vault at ~/mypass.scrypt
mypass add github.com mikael # generate a password for an entry, copy it to the clipboard
mypass get github.com # copy the password to the clipboard again
mypass list # show all entries
mypass # browse and edit interactively
Commands
| Command | Description |
|---|
mypass init | Create a new empty vault. Asks for the passphrase twice. |
mypass update-params [--log-n N] [--r R] [--p P] | Retune vault scrypt costs or set them explicitly. |
mypass change-passphrase | Change the master passphrase; confirm the new passphrase interactively. |
mypass repair | Inspect malformed and duplicate entries; remove or rename duplicates, then save with a .bak backup. |
mypass get <name> [--show|--show-credentials] | Print the username (if present) and copy the password to the clipboard. --show prints username and password on separate lines; --show-credentials prints username:password. |
mypass list [PATTERN] | List entries, optionally filtered by a case-insensitive substring of the name. |
mypass add <name> [username] [options] | Add an entry. The password is generated (and copied to the clipboard) unless --input-password is given. |
mypass update <name> [username] [options] | Change specified fields of an existing entry; retain all omitted fields. |
mypass remove <name> [--yes] | Remove an entry, after confirmation (--yes skips it). |
mypass generate [options] | Generate a password without storing it. |
mypass export | Print the decrypted vault as JSON on stdout, for backup or migration. |
mypass | Browse, create, update and delete entries in an interactive terminal. |
mypass install-browser [--uninstall] | Install (or remove) the Firefox native-messaging manifest for the browser integration. See below. |
New vaults automatically tune scrypt to approximately one second on the current machine,
using at least logN=17, r=8, p=1 (128 MiB). Tuning increases p while retaining this memory cost;
on slower machines the minimum cost may take longer than one second.
Use mypass init --log-n 18 --r 8 --p 1 to select costs explicitly. If any parameter is
specified, omitted parameters use 17,8,1; explicit choices may be lower than the automatic minimum.
All vault updates, repairs, and passphrase changes retain the vault's existing costs.
Use mypass update-params to retune an existing vault, or supply the same options to choose costs.
Retuning can lower previously selected costs; the command prints the old and new parameters.
Re-encryption preserves the exact vault contents and keeps the previous encrypted vault as .bak.
Use mypass change-passphrase to change the vault's master passphrase. Enter the
current passphrase, then enter and confirm the new passphrase. With
--passphrase-stdin, supply the current passphrase on the first line and the new
passphrase on the second line (no confirmation line). The .bak backup retains
the previous vault encrypted with the old passphrase; existing external backups
also retain their original passphrases.
Command options:
--password-length <n> — length of the generated password (default 16)--password-charset <chars> — characters to generate from; duplicate Unicode
scalar values are rejected (default: letters, digits and -)--input-password — type the password instead of generating one
(add/update only)--url <url> — the site this entry is for, used by the Firefox integration
(add/update only)--realm <realm> — the HTTP authentication realm on that site
(add/update only). Requires a URL in the resulting entry--change-password — on update, explicitly replace the password; required
for password generation/input options and --show--clear-username, --clear-url, --clear-realm — explicitly clear the
corresponding field on update. Omitted fields are kept. Clearing a URL
with an existing realm also requires --clear-realm. An update with no
requested changes is rejected--show — print the password to stdout instead of copying it to the
clipboard--show-credentials — on get, print username:password without a
trailing newline instead of copying the password; an empty username prints
as :password. A username containing : makes this format ambiguous for
consumers that split on the colon.
Global options:
This is the beginning of the README. Read the rest at the original. Read the full README ↗
