pwd.sh is a Bash script to manage text secrets, such as passwords, using GnuPG.

Each secret is saved to a randomly-named file in a directory. An encrypted index maps usernames to secrets contained in files. Both the index and files can be decrypted directly with GnuPG - without pwd.sh.

Install

Download from Releases, or to use the latest version, clone the repository:

git clone https://github.com/drduh/pwd.sh

Or download the script directly:

wget https://raw.githubusercontent.com/drduh/pwd.sh/main/pwd.sh

Use

Run the script interactively using ./pwd.sh or symlink to a directory in PATH:

• w - write (create) a secret
• r - read (access) a secret
• l - list secret names and paths
• s - generate a random secret
• u - generate a random username
• b - archive materials for backup
• v - print version information
• h - print help text

Options can also be passed on the command line.

Create a 20-character secret for userName:

./pwd.sh w userName 20

Read secret for userName:

./pwd.sh r userName

Secrets are stored with an epoch timestamp for revision control and the most recent version is read by default. To list all secrets or read a specific version of a secret:

./pwd.sh l
./pwd.sh r userName@1574723600

Create a backup tar archive:

./pwd.sh b

Restore from backup:

tar xvf pwd*tar

Configuration

pwd.sh can be configured with environment variables as follows:

Variable	Description	Default	Available options
PWDSH_STORE	secret storage directory	v4-pwd.sh.secret	any valid string
PWDSH_INDEX	index file name	v4-pwd.sh.index	any valid string
PWDSH_CLIP_CMD	clipboard to use	xclip	pbcopy on macOS
PWDSH_CLIP_ARG	arguments to pass to clipboard command	unset (disabled)	-i -selection clipboard to use primary (control-v) clipboard with xclip
PWDSH_CLIP_OUT	secret output destination, will set to screen without clipboard	clipboard	clipboard or screen
PWDSH_CLIP_SEC	seconds to clear secret from clipboard/screen	10	any valid integer
PWDSH_COPY	copy secret to clipboard before write	unset (disabled)	1 or true to enable
PWDSH_COMMENT	unencrypted comment to include in index and secret files	unset	any valid string
PWDSH_ECHO	character used to echo password input	*	any valid character
PWDSH_LEN	default secret length	20	any valid integer
PWDSH_CHAR	character set for secret	A-Za-z0-9!@#$%^&*()_+	any valid characters
PWDSH_BACKUP_NAME	backup archive file name	v4-pwd.sh.hostname.2026-12-31.tar	any valid string
PWDSH_PEPPER	file containing Pepper	unset (disabled)	any valid file path

See config/gpg.conf for recommended GnuPG options.

Also see drduh/Purse which integrates with YubiKey instead of using a passphrase to access secrets.

Pepper

The Pepper is an additional string appended to the storage passphrase to improve its strength. When the PWDSH_PEPPER option is set to a valid path, a secret value is generated and displayed once, then saved to the respective file.

The Pepper should be written down (for example, transcribed with passphrase.html or passphrase.txt template) and stored in a secure, durable location for backup.

This feature may enable use of a more memorable - and possibly weaker passphrase - for convenience, while still guarding backups against passphrase brute-force attempts (provided the Pepper is backed up separately).

The Pepper feature is opt-in and has no effect unless explicitly enabled.

[!IMPORTANT] The Pepper is not included in backup archives! Without the Pepper, secret storage will not be accessible with the passphrase alone!