Package: qpass
The qpass program is a simple command line frontend forpass, the standard
unix password manager. It makes it very easy to quickly find and copy specific
passwords in your~/.password-storeto the clipboard. The package is
currently tested on cPython 2.6, 2.7, 3.4, 3.5, 3.6 and PyPy (2.7). It’s
intended to work on Linux as well as macOS, although it has only been tested on
Linux.InstallationUsageCommand lineWhy use pass?GPG encryptionGit version controlSSH secure transportHistorySupport for multiple password storesAbout the nameContactLicenseInstallationThe qpass package is available onPyPIwhich means installation should be as
simple as:$pipinstallqpassThere’s actually a multitude of ways to install Python packages (e.g. theper
user site-packages directory,virtual environmentsor just installing
system wide) and I have no intention of getting into that discussion here, so
if this intimidates you then read up on your options before returning to these
instructions ;-).UsageThere are two ways to use the qpass package: As the command line programqpassand as a Python API. For details about the Python API please refer to
the API documentation available onRead the Docs. The command line interface
is described below.Command lineUsage:qpass [OPTIONS] KEYWORD..Search your password store for the given keywords or patterns and copy the
password of the matching entry to the clipboard. When more than one entry
matches you will be prompted to select the password to copy.If you provide more than one KEYWORD all of the given keywords must match,
in other words you’re performing an AND search instead of an OR search.Instead of matching on keywords you can also enter just a few of the characters
in the name of a password, as long as those characters are in the right order.
Some examples to make this more concrete:The pattern ‘pe/zbx’ will match the name ‘Personal/Zabbix’.The pattern ‘ba/cc’ will match the name ‘Bank accounts/Creditcard’.When a password is copied to the clipboard, any text after the first line will
be shown on the terminal, to share any additional details about the password
entry (for example the associated username or email address). The-q,--quietoption suppresses this text.Supported options:OptionDescription-e,--editEdit the matching entry instead of copying it to the clipboard.-l,--listList the matching entries on standard output.-n,--no-clipboardDon’t copy the password of the matching entry to the clipboard, instead
show the password on the terminal (by default the password is copied to
the clipboard but not shown on the terminal).-p,--password-store=DIRECTORYSearch the password store inDIRECTORY. If this option isn’t given
the password store is located using the$PASSWORD_STORE_DIRenvironment variable. If that environment variable isn’t
set the directory ~/.password-store is used.You can use the-p,--password-storeoption multiple times to search more
than one password store at the same time. No distinction is made between
passwords in different password stores, so the names of passwords need to
be recognizable and unique.-f,--filter=PATTERNDon’t show lines in the additional details which match the case insensitive
regular expression given byPATTERN. This can be used to avoid revealing
sensitive details on the terminal. You can use this option more than once.-x,--exclude=GLOBIgnore passwords whose name matches the givenGLOBfilename pattern.
This argument can be repeated to add multiple exclude patterns.-v,--verboseIncrease logging verbosity (can be repeated).-q,--quietDecrease logging verbosity (can be repeated).-h,--helpShow this message and exit.Why use pass?In 2016 I was looking for a way to securely share passwords and other secrets
between my laptops and smartphones. I’m not going to bore you with the full
details of my quest to find the ultimate password manager but I can highlight a
few points aboutpassthat are important to me:GPG encryptionGit version controlSSH secure transportGPG encryptionGPGis a cornerstone of computer security and it’s open source. This means it
receives quite a lot of peer review, which makes it easier for me to trust
(versusdo-it-yourselfcryptography). BecausepassusesGPGto implement its
encryption my trust extends directly topass. Of course it also helps that I
had years of experience withGPGbefore I started usingpass:-).Git version controlThegitintegration inpassmakes it very easy to keep your passwords under
version control and synchronize the passwords between multiple systems.Gitis
a great version control system and while I sometimes get annoyed by the fact
thatgit pullautomatically merges, it’s actually the perfect default
choice for a password store. As an added bonus you have a history of every
change you ever made to your passwords.SSH secure transportI’ve been usingSSHto access remote systems over secure connections fora
very long timenow so I’m quite comfortable setting up and properly securing
SSH servers. In the case ofpassI use SSH to synchronize my passwords between
my laptops and smartphones via a central server that hosts the private git
repository.HistoryShortly after starting to usepassI realized that I needed a quick and easy
way to copy any given password to the clipboard, something smarter than thepassprogram.I tried out several GUI frontends but to be honest each of them felt clumsy, I
guess that through my work as a system administrator and programmer I’ve grown
to prefer command line interfaces over graphical user interfaces :-). For a few
weeks I triedupass(a somewhat fancy command line interface) but the lack of
simple things like case insensitive search made me stop using it.Out of frustration I hacked together a simple Python script that would perform
case insensitive substring searches on my passwords, copying the password to
the clipboard when there was exactly one match. I called the Python script
qpass, thinking that it was similar in purpose toupassbut much quicker
for me to use, soq(for quick) instead ofu.After using that Python script for a while I noticed that case insensitive
substring searching still forced me to specify long and detailed patterns in
order to get a unique match. Experimenting with other ways to match unique
passwords I came up with the idea of performing a “fuzzy match” against the
pathname of the password (including the directory components). The fuzzy
searching where a pattern likee/zmatchesPersonal/Zabbixhas since
become my primary way of interacting with my password stores.Support for multiple password storesOne great aspect ofpassis thegitintegration that makes it easy to share a
password store between several devices[1]or people[2]. This use case makes
it much more likely that you’ll end up using multiple password stores, which is
something thatpassdoesn’t specifically make easy.This is why I added support for querying multiple password stores to qpass in
version 2.0. For now I’ve kept things simple which means no distinction is made
between passwords in different password stores, so the names of passwords need
to be recognizable and unique.[1]For example I synchronize my password store between my personal laptop
and my work laptop and I also have access to my password store on my
smartphones (thanks to the Android applicationPassword Store).[2]My team at work also usespassso because I was already usingpassfor
personal use, I now find myself frequently searching through multiple
password stores.About the nameAs explained above I initially wrote and named qpass with no intention of ever
publishing it. However since then my team at work has started usingpassto
manage a shared pasword store and ever since we started doing that I’ve missed
the ability to query that password store using qpass :-).Publishing qpass as an open source project with a proper Python package
available onPyPIprovides a nice way to share qpass with my team and it also
forces me to maintain proper documentation and an automated test suite.While considering whether to publish qpass I found that there’s an existing
password manager out there calledQPass.
I decided not to rename my project for the following reasons:While both projects are password managers, they are intended for very
different audiences (I’m expecting my end users to be power users that are
most likely system administrators and/or programmers).I consider the name of the executable of a GUI program to be a lot less
relevant than the name of the executable of a command line program. This is
because the GUI will most likely be started via an application launcher,
which means the executable doesn’t even need to be on the$PATH.Let’s be honest,passis already for power users only, so my qpass frontend
is most likely not going to see a lot of users ;-).ContactThe latest version of qpass is available onPyPIandGitHub. The
documentation is hosted onRead the Docsand includes achangelog. For bug
reports please create an issue onGitHub. If you have questions, suggestions,
etc. feel free to send me an e-mail atpeter@peterodding.com.LicenseThis software is licensed under theMIT license.© 2018 Peter Odding.