Manage secrets with Bash and GnuPG symmetric encryption
See the codepwd.sh is a Bash script to manage text secrets, such as passwords, using GnuPG.
Each secret is saved to a randomly-named file in a directory. An encrypted index maps usernames to secrets contained in files. Both the index and files can be decrypted directly with GnuPG - without pwd.sh.
Download from Releases, or to use the latest version, clone the repository:
git clone https://github.com/drduh/pwd.sh
Or download the script directly:
wget https://raw.githubusercontent.com/drduh/pwd.sh/main/pwd.sh
Run the script interactively using ./pwd.sh or symlink to a directory in PATH:
w - write (create) a secretr - read (access) a secretl - list secret names and pathss - generate a random secretu - generate a random usernameb - archive materials for backupv - print version informationh - print help textOptions can also be passed on the command line.
Create a 20-character secret for userName:
./pwd.sh w userName 20
Read secret for userName:
./pwd.sh r userName
Secrets are stored with an epoch timestamp for revision control and the most recent version is read by default. To list all secrets or read a specific version of a secret:
./pwd.sh l
./pwd.sh r userName@1574723600
Create a backup tar archive:
./pwd.sh b
Restore from backup:
tar xvf pwd*tar
pwd.sh can be configured with environment variables as follows:
| Variable | Description | Default | Available options |
|---|---|---|---|
PWDSH_STORE | secret storage directory | v4-pwd.sh.secret | any valid string |
PWDSH_INDEX | index file name | v4-pwd.sh.index | any valid string |
PWDSH_CLIP_CMD | clipboard to use | xclip | pbcopy on macOS |
PWDSH_CLIP_ARG | arguments to pass to clipboard command | unset (disabled) | -i -selection clipboard to use primary (control-v) clipboard with xclip |
PWDSH_CLIP_OUT | secret output destination, will set to screen without clipboard | clipboard | clipboard or screen |
PWDSH_CLIP_SEC | seconds to clear secret from clipboard/screen | 10 | any valid integer |
PWDSH_COPY | copy secret to clipboard before write | unset (disabled) | 1 or true to enable |
PWDSH_COMMENT | unencrypted comment to include in index and secret files | unset | any valid string |
PWDSH_ECHO | character used to echo password input | * | any valid character |
PWDSH_LEN | default secret length | 20 | any valid integer |
PWDSH_CHAR | character set for secret | A-Za-z0-9!@#$%^&*()_+ | any valid characters |
PWDSH_BACKUP_NAME | backup archive file name | v4-pwd.sh.hostname.2026-12-31.tar | any valid string |
PWDSH_PEPPER | file containing Pepper | unset (disabled) | any valid file path |
See config/gpg.conf for recommended GnuPG options.
Also see drduh/Purse which integrates with YubiKey instead of using a passphrase to access secrets.
The Pepper is an additional string appended to the storage passphrase to improve its strength. When the PWDSH_PEPPER option is set to a valid path, a secret value is generated and displayed once, then saved to the respective file.
The Pepper should be written down (for example, transcribed with passphrase.html or passphrase.txt template) and stored in a secure, durable location for backup.
This feature may enable use of a more memorable - and possibly weaker passphrase - for convenience, while still guarding backups against passphrase brute-force attempts (provided the Pepper is backed up separately).
The Pepper feature is opt-in and has no effect unless explicitly enabled.
[!IMPORTANT] The Pepper is not included in backup archives! Without the Pepper, secret storage will not be accessible with the passphrase alone!
108 followers · starred Jul 2015
439 followers · starred Jul 2015
2,321 followers · starred Jul 2015
5,852 followers · starred Feb 2018
Manage secrets with Bash and GnuPG symmetric encryption
See the codepwd.sh is a Bash script to manage text secrets, such as passwords, using GnuPG.
Each secret is saved to a randomly-named file in a directory. An encrypted index maps usernames to secrets contained in files. Both the index and files can be decrypted directly with GnuPG - without pwd.sh.
Download from Releases, or to use the latest version, clone the repository:
git clone https://github.com/drduh/pwd.sh
Or download the script directly:
wget https://raw.githubusercontent.com/drduh/pwd.sh/main/pwd.sh
Run the script interactively using ./pwd.sh or symlink to a directory in PATH:
w - write (create) a secretr - read (access) a secretl - list secret names and pathss - generate a random secretu - generate a random usernameb - archive materials for backupv - print version informationh - print help textOptions can also be passed on the command line.
Create a 20-character secret for userName:
./pwd.sh w userName 20
Read secret for userName:
./pwd.sh r userName
Secrets are stored with an epoch timestamp for revision control and the most recent version is read by default. To list all secrets or read a specific version of a secret:
./pwd.sh l
./pwd.sh r userName@1574723600
Create a backup tar archive:
./pwd.sh b
Restore from backup:
tar xvf pwd*tar
pwd.sh can be configured with environment variables as follows:
| Variable | Description | Default | Available options |
|---|---|---|---|
PWDSH_STORE | secret storage directory | v4-pwd.sh.secret | any valid string |
PWDSH_INDEX | index file name | v4-pwd.sh.index | any valid string |
PWDSH_CLIP_CMD | clipboard to use | xclip | pbcopy on macOS |
PWDSH_CLIP_ARG | arguments to pass to clipboard command | unset (disabled) | -i -selection clipboard to use primary (control-v) clipboard with xclip |
PWDSH_CLIP_OUT | secret output destination, will set to screen without clipboard | clipboard | clipboard or screen |
PWDSH_CLIP_SEC | seconds to clear secret from clipboard/screen | 10 | any valid integer |
PWDSH_COPY | copy secret to clipboard before write | unset (disabled) | 1 or true to enable |
PWDSH_COMMENT | unencrypted comment to include in index and secret files | unset | any valid string |
PWDSH_ECHO | character used to echo password input | * | any valid character |
PWDSH_LEN | default secret length | 20 | any valid integer |
PWDSH_CHAR | character set for secret | A-Za-z0-9!@#$%^&*()_+ | any valid characters |
PWDSH_BACKUP_NAME | backup archive file name | v4-pwd.sh.hostname.2026-12-31.tar | any valid string |
PWDSH_PEPPER | file containing Pepper | unset (disabled) | any valid file path |
See config/gpg.conf for recommended GnuPG options.
Also see drduh/Purse which integrates with YubiKey instead of using a passphrase to access secrets.
The Pepper is an additional string appended to the storage passphrase to improve its strength. When the PWDSH_PEPPER option is set to a valid path, a secret value is generated and displayed once, then saved to the respective file.
The Pepper should be written down (for example, transcribed with passphrase.html or passphrase.txt template) and stored in a secure, durable location for backup.
This feature may enable use of a more memorable - and possibly weaker passphrase - for convenience, while still guarding backups against passphrase brute-force attempts (provided the Pepper is backed up separately).
The Pepper feature is opt-in and has no effect unless explicitly enabled.
[!IMPORTANT] The Pepper is not included in backup archives! Without the Pepper, secret storage will not be accessible with the passphrase alone!
108 followers · starred Jul 2015
439 followers · starred Jul 2015
2,321 followers · starred Jul 2015
5,852 followers · starred Feb 2018