I'm looking for a password manager for the Linux (Debian/Ubuntu) command line to be used by a department of developers.

We are currently using pwman3 and content with it but want to migrate to a program that does not change its database format so often in incompatible ways.

What I need:

  • must be available as a Linux (Ubuntu LTS, Debian) command line application
  • secure storage (i.e. good encryption)
  • centralized storage possible (an NFS share or a Git repo would be good enough), no cloud please
  • data file location should be configurable
  • free/open source software

Preferred options (not mandatory)

  • nice GUI
  • is contained in Ubuntu repositories (PPA is fine, a .deb would do, no problems if it comes as .jar or ready-to-go .tar.gz however, or source if not too many dependencies (we feel fit enough to configure && make && check-install ;))

Candidates tried, but failed:

  • pwman3: We use it now with a central DB file (shared via NFS), but the DB format was changed in an incompatible way between Ubuntu 14.04 and 15.10, so that the 14.04 clients can not read the DB stored by 15.10.
  • pwsafe: A command line client for Password Safe files, but sadly it has not been updated since 2005.
  • 2
    For the very same issue (collection of username/password) we've used a plain text file with two GPG scripts: 1 script to only "view" and 1 to edit (add/change entries). The file would be encrypted using the public keys of all participants, so each dev can decrypt it with his/her private key. Easy approach, no permanently changing database formats :)
    – Izzy
    Apr 26, 2016 at 9:59
  • 1
    Afraid not. That was a customer I worked for several years ago, and I didn't create the scripts. But with the concept in mind, it shouldn't be too complicated to create them (not that I volunteer ;) Quick hint: Encrypting and decrypting documents - GnuPG and on our sister site Encryption with multiple different keys?
    – Izzy
    Apr 26, 2016 at 12:38
  • 1
    Great question now!
    – Nicolas Raoul
    Apr 26, 2016 at 13:20
  • 1
    Does LastPass meat your openness requirement? The CLI client is open source (indeed, it's even packaged in Debian), but the service it uses is not.
    – derobert
    May 13, 2016 at 18:21
  • 1
    @derobert: Question is updated: "No cloud please" May 13, 2016 at 23:59

3 Answers 3



I was similarly dissatisfied with most password managers and wanted a minimalist/command-line alternative, so I created Kruptos. Kruptos simply encrypts and decrypts the ~/.kruptos/ directory. This provides several benefits:

  • Non-intrusive: store sensitive info the way you want
  • Flexible lookup: search/modify passwords with command line tools
  • Modifiable: the source code is simple and easily changed
  • Distributable: compresses to a tarball when encrypted


Kruptos has 3 pieces of functionality:

  • Initialize: create ~/.kruptos/ and ~/.kruptos/.phrazein with default master password pswd
    • The first line of .phrazein is the master password
  • Encrypt: compress, encrypt and then remove ~/.kruptos/ which creates the tarball
  • Decrypt: decrypt, decompress and then remove .kruptos.tar.gz.aes which creates the directory
| Functionality | Command   |
| Initialize    | kruptos i |
| Encrypt       | kruptos e |
| Decrypt       | kruptos   |


function kruptos
    if [[ $# -eq 1 ]]; then
    if [[ $DOWHAT == "d" ]]; then
        pushd . &>/dev/null
        cd ~/
        openssl aes-256-cbc -d  -in .kruptos.tar.gz.aes | tar -xz -f - --strip-components=2 && rm ~/.kruptos.tar.gz.aes
        popd &>/dev/null
    elif [[ $DOWHAT == "e" ]]; then
        tar -zcf - ~/.kruptos | openssl aes-256-cbc -out ~/.kruptos.tar.gz.aes -kfile ~/.kruptos/.phrazein && rm -r ~/.kruptos
    elif [[ $DOWHAT == "i" ]]; then
        mkdir ~/.kruptos
        echo pswd > ~/.kruptos/.phrazein
        echo "$DOWHAT is not an acceptable flag"



Kruptos origins


enter image description here



The KeePass is available under http://keepass.info/ . There is a command line client http://kpcli.sourceforge.net/ or a Java API so you can roll your own.

I am using it for years now and it works well on Mac, Win, and Linux.



I made a password manager for the command line. Just install it with:

sudo apt install python3-pip  
sudo pip3 install passme

It stores the information of "seed for password" in a text file, and you can manage it with git. It creates your password from "seed for password" and a master password you remember. It can also create a html file to be used from your mobile device.

For what you need:

  • It is available from the Linux command line.
  • Only the "seed for password" is stored, which does not reveal your password unless your master password is known.
  • It uses only a single text file, which is easily manageable with git repo.
  • Data file location is configurable.
  • MIT license

For more information:

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.