gokey: Open Source Identity & Access Management (IAM)

gokey is a free, open source identity & access management (iam) project written in Go and released under BSD-3-Clause. It has 2,435 GitHub stars, 109 forks and 8 open issues, and was last pushed 2 months ago. On this registry it ranks #25 of 30 tracked projects in Identity & Access Management (IAM), with 5 head-to-head comparisons available.

What is gokey?

gokey is a vaultless password and key generator written in Go that derives passwords and cryptographic private keys on demand from a master password or a seed file instead of storing them in a vault, aimed at developers and system administrators who want deterministic credentials available anywhere without managing, backing up, or syncing a password store.

What it is

gokey is a single command-line utility, distributed as a Go binary, that turns a master password plus a realm string into a reproducible password or cryptographic private key. It belongs to the Go command-line tooling ecosystem and is published by Cloudflare under the BSD-3-Clause licence. The project is explicitly stateless: it holds no local database, produces no vault file to protect, and performs its derivation the same way on any machine where the binary runs. The supported output types span passwords, raw symmetric key material, and asymmetric private keys for ECC and RSA.

The concrete problem it solves is vault custody. A conventional password manager requires the user to store secrets in a vault, keep that vault backed up, synchronise it across devices, and often trust a third party with its management. gokey replaces that vault entirely with derivation: each unique combination of a master password and a realm string yields a unique password, so nothing needs to be saved and nothing needs to be trusted to an outside service. The realm, typically a resource URL or key-usage label, is the only per-credential input that must be remembered.

Key capabilities

Deterministic derivation of passwords and keys from a master password and a realm string, so the same inputs always reproduce the same credential.
A range of output types selected with -t: pass, seed, raw, ec256, ec384, ec521, rsa2048, rsa4096, x25519, and ed25519.
Seed-file entropy mode, where -t seed generates a random blob that can later be supplied through -s to raise the entropy available for key generation.
Flexible master-password input, through -p on the command line, -P pointing at a password file, or an interactive prompt when neither is given.
Output control with -o for the destination, defaulting to stdout, and -l for length, defaulting to 10 characters for pass and 32 bytes for raw.
Byte-level seed handling through -skip, which allows a number of bytes to be skipped when reading a seed file.
An -u flag that permits generation without a seed file, explicitly marked UNSAFE in the documentation.

Who uses it and how

Developers who want a distinct password for every service, derived from a realm string such as example.com, without operating a synced vault.
Administrators who need to reproduce the same credential on a fresh machine with no network access, since derivation needs only the binary, the master password, and the realm.
Users generating asymmetric key material, such as ed25519 or rsa4096 private keys, on the fly from a seed file rather than storing keypairs.
Users producing raw symmetric key bytes for use as a manually managed encryption key.
Teams that would rather not hand vault custody to a third party, because nothing is stored to hand over.

Getting started

Install with go install github.com/cloudflare/gokey/cmd/gokey@latest, which places the gokey binary in $GOPATH/bin (by default $HOME/go/bin); precompiled binaries are also available in the Releases section. A basic run looks like gokey -p super-secret-master-password -r example.com.

How it compares

No list of paid products this project replaces is provided in the facts, and no similar tools are named, so gokey stands alone in this registry. On the axes the documentation supports, it is distinguished by being vaultless and stateless rather than by comparison to any named competitor. Classification places it in Security & Privacy / Identity & Access Management.

When to use it — and when not to

A self-hoster operates no server, database, or object storage, but must safeguard the master password and any seed file, because loss of either destroys access to every derived credential with no recovery path. In simple mode the master password is the single source of entropy, which the README calls acceptable for passwords but insufficient for keys, so key generation should use a seed file — and the -u flag that bypasses this is marked UNSAFE. Anyone who needs credential recovery, centralised rotation, shared-team access, or audit logging should not choose this tool, since it provides none of those by design.

project readme (upstream, from github) — read inline

gokey

A simple vaultless password manager in Go

gokey is a password manager, which does not require a password vault. Instead of storing your passwords in a vault it derives your password on the fly from your master password and supplied realm string (for example, resource URL). This way you do not have to manage, backup or sync your password vault (or trust its management to a third party) as your passwords are available immediately anywhere.

example

gokey -p super-secret-master-password -r example.com

options

-o - by default gokey outputs generated data to stdout
-P - path to master password file which will be used to generate other passwords/keys or to encrypt seed file (see Modes of operation below, if no master password or master password file is provided, gokey will ask for it interactively)
-p - master password which will be used to generate other passwords/keys or to encrypt seed file (see Modes of operation below, if no master password or master password file is provided, gokey will ask for it interactively)
-r - any string which identifies requested password/key, most likely key usage or resource URL
-s - needed, if you want to use seed file instead of master password as an entropy source (see Modes of operation below); can be generated with -t seed flag as described below
-skip - number of bytes to skip when reading seed file
-u - UNSAFE, allow generating keys without using a seed file (see Modes of operation below)
-t - requested password/key output type
-l - number of characters in the generated password or number of bytes in the generated raw stream (default 10 for "pass" type and 32 for "raw" type)

Supported password/key types:

pass - default, generates a password
seed - generates a seed file, which can be used with -s option later
raw - generates 32 random bytes (can be used as a symmetric key)
ec256 - generates ECC P-256 private key
ec384 - generates ECC P-384 private key
ec521 - generates ECC P-521 private key
rsa2048 - generates 2048-bit RSA private key
rsa4096 - generates 4096-bit RSA private key
x25519 - generates x25519 (also known as curve25519) ECC private key
ed25519 - generates ed25519 ECC private key

Installation

The gokey command-line utility can be downloaded and compiled using standard go install approach. Assuming you have Go installed, do

go install github.com/cloudflare/gokey/cmd/gokey@latest

The gokey binary should appear in your $GOPATH/bin directory. (Default $HOME/go/bin)

Precompiled binaries are also available in the Releases section

Modes of operation

gokey can generate passwords and cryptographic private keys (ECC and RSA keys are currently supported). However, without any additional options specified it uses your master password as a single source of entropy for generated data. For passwords it is acceptable most of the time, but keys usually have much higher entropy requirements.

For cases, where higher entropy is required for generated passwords/keys, gokey can use a seed file (a blob with random data) instead of the master password as a source of entropy.

Simple mode (without a seed file)

In simple mode passwords are derived directly from your master password and the realm string. That is each unique combination of a master password and a realm string will produce a unique password.

For example, if your master password is super-secret-master-password and you want to generate a password for example.com, you would invoke gokey like

gokey -p super-secret-master-password -r example.com

If you need a password for a different resource, (example2.com), you would change the realm string

gokey -p super-secret-master-password -r example2.com

This way you need to remember only your master password and you can always recreate passwords for your services/resources.

NOTE: In this mode generated passwords are as strong as your master password, so do have your master password strong enough. You can also derive private keys from your master password, but keep in mind, that these keys will have low entropy. That is why it is considered unsafe, so gokey does not allow it by default. If you really know what you are doing, you can override this default by supplying -u flag.

Using a seed file

If you plan to generate not only passwords, but also private keys or you want to have your passwords/keys with higher entropy, you can use a seed file instead of the master password. You still need to supply a master password, when invoking gokey, but it will be used only to protect the seed file itself; all generated passwords/keys will be derived from the data in the seed file. gokey uses seed files protected (encrypted) with your master password, so it is reasonably safe to store/backup seed files to a third party location, such as Google Drive or Dropbox.

To generate an encrypted seed file, use

gokey -p super-secret-master-password -t seed -o seedfile

This will create a seed file seedfile with 256 bytes of random data. The data is encrypted using AES-256-GCM mode and super-secret-master-password as a key.

Then, to generate EC-256 private key for example.com, use

gokey -p super-secret-master-password -s seedfile -r example.com -t ec256

NOTE: you still need to remember your master password and keep a backup copy of your seed file. If you forget your master password or lose your seed file, you will lose all derived passwords/keys as well.

Frequently asked questions

Is gokey free to use?

gokey is open source under the BSD-3-Clause licence. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does gokey do?

A simple vaultless password manager in Go

What is gokey written in?

gokey is primarily written in Go. Its source is publicly available at https://github.com/cloudflare/gokey, and it has 2,435 GitHub stars.