drduh/pwd.sh

pwd.sh is a Bash script to manage text secrets, such as passwords, using GnuPG.

Each secret is saved to a randomly-named file in a directory. An encrypted index maps usernames to secrets contained in files. Both the index and files can be decrypted directly with GnuPG - without pwd.sh.

Install

Download from Releases, or to use the latest version, clone the repository:

git clone https://github.com/drduh/pwd.sh

Or download the script directly:

wget https://raw.githubusercontent.com/drduh/pwd.sh/main/pwd.sh

Use

Run the script interactively using ./pwd.sh or symlink to a directory in PATH:

• w - write (create) a secret
• r - read (access) a secret
• l - list secret names and paths
• s - generate a random secret
• u - generate a random username
• b - archive materials for backup
• v - print version information
• h - print help text

Options can also be passed on the command line.

Create a 20-character secret for userName:

./pwd.sh w userName 20

Read secret for userName:

./pwd.sh r userName

Secrets are stored with an epoch timestamp for revision control and the most recent version is read by default. To list all secrets or read a specific version of a secret:

./pwd.sh l
./pwd.sh r userName@1574723600

Create a backup tar archive:

./pwd.sh b

Restore from backup:

tar xvf pwd*tar

Configuration

pwd.sh can be configured with environment variables as follows:

See config/gpg.conf for recommended GnuPG options.

Also see drduh/Purse which integrates with YubiKey instead of using a passphrase to access secrets.

Pepper

The Pepper is an additional string appended to the storage passphrase to improve its strength. When the PWDSH_PEPPER option is set to a valid path, a secret value is generated and displayed once, then saved to the respective file.

The Pepper should be written down (for example, transcribed with passphrase.html or passphrase.txt template) and stored in a secure, durable location for backup.

This feature may enable use of a more memorable - and possibly weaker passphrase - for convenience, while still guarding backups against passphrase brute-force attempts (provided the Pepper is backed up separately).

The Pepper feature is opt-in and has no effect unless explicitly enabled.

[!IMPORTANT] The Pepper is not included in backup archives! Without the Pepper, secret storage will not be accessible with the passphrase alone!