pass for developers: the 10 commands you actually need

pass (the standard unix password manager) stores every secret as an encrypted file: one file per entry, arranged in a directory tree, each file encrypted to your GPG key. That design is why developers like it — secrets are just files, so they fit scripts, git, and plain-text tooling. The man page is long, but daily work only needs ten commands. Each entry below shows the purpose and a typical invocation.

1. pass init — create the store

Sets up ~/.password-store and records which GPG key encrypts everything.

pass init 0x1A2B3C4D

Run this before anything else, and again when you rotate your GPG key.

2. pass insert — add a secret

Reads the value from stdin, so it never appears in your shell history.

pass insert github/pat

Prompts twice and writes the entry. Use for tokens, passwords, and any value you already have.

3. pass generate — create a random password

Generates a random password, stores it, and prints it once.

pass generate github/pat 32

The length argument is optional; add -n to skip symbols.

4. pass show — retrieve a secret

Prints the entry to stdout. Add -c to copy the first line to the clipboard instead, which keeps the value out of your terminal scrollback and shell history.

pass show github/pat

5. pass ls — list the store

Shows the full entry tree without decrypting anything, so it is fast even on a large store.

pass ls

Use it to see what exists and to get the exact path of an entry.

6. pass find — search by name

Fuzzy-matches entry names against a query.

pass find github

Useful when you remember part of a name but not the full path.

7. pass edit — edit a multi-line entry

Opens the decrypted entry in $EDITOR. Use it for entries with multiple fields, like a card number or a server config.

pass edit servers/prod

8. pass mv / pass cp — reorganize entries

Moves or copies an entry to a new path without re-typing the value.

pass mv servers/prod servers/prod-old
pass cp github/pat github/pat-backup

Directory moves work too: pass mv old-dir new-dir.

9. pass rm — delete an entry

Removes an entry. Add -r for a whole directory.

pass rm github/pat-backup

10. pass git — version-control the store

Initializes a git repository inside the store so every change is committed and pushable.

pass git init
pass git push

Pulling on another machine gives you a synchronized, history-tracked store — the main reason pass works well across a team or across machines.

That is the whole daily surface: create, read, search, edit, reorganize, delete, and sync. Everything else in pass is a variation on those.

Because the store is just encrypted files, it is easy to build tooling around it. trustless reads your existing pass store as its default backend, so agents can use secrets without seeing them — trustless run -s KEY -- cmd injects a value into a subprocess and scrubs it from output. The commands are documented under /docs/commands/.

If you had to restore your password store from memory and a backup GPG key today, which of these commands would you be unsure about?