pwd.sh: Open Source Identity & Access Management (IAM)

What is pwd.sh?

pwd.sh is a Bash script that manages text secrets such as passwords by storing each one in a GnuPG symmetric-encrypted file, and it is for people who work in a terminal and prefer to keep their own encrypted store rather than hand it to a hosted password service.

What it is

The project lives in the Unix shell and GnuPG ecosystem: one Bash script that stores each secret in a randomly named file inside a storage directory, with an encrypted index mapping usernames to the secrets held in those files. It runs interactively as ./pwd.sh, or from anywhere once symlinked into a directory on PATH, offering single-letter commands for writing, reading, listing, generating secrets and usernames, and archiving backups. Because both the index and the secret files are ordinary GnuPG output, everything can be decrypted directly with GnuPG without pwd.sh.

The concrete problem is bookkeeping: encrypting one file with GnuPG is easy, but knowing which ciphertext belongs to which account, keeping earlier versions and producing a restorable archive is not. pwd.sh replaces the habit of hand-encrypting loose password files with gpg, and fills the role a conventional password manager would while leaving the store readable by ordinary tooling.

Key capabilities

An interactive single-key menu: w writes a secret, r reads one, l lists secret names and paths, s generates a random secret, u generates a random username, b archives materials for backup, v prints version information and h prints help text.
Non-interactive calls such as ./pwd.sh w userName 20 and ./pwd.sh r userName, with PWDSH_LEN, PWDSH_CHAR and PWDSH_ECHO tuning generated secrets.
A storage directory of randomly named secret files plus an encrypted index, defaulting to v4-pwd.sh.secret and v4-pwd.sh.index and changed with PWDSH_STORE and PWDSH_INDEX.
Revision history through epoch timestamps: ./pwd.sh r userName@1574723600 reads a specific version while a plain read returns the most recent one.
Backup with ./pwd.sh b, which writes a tar archive (default v4-pwd.sh.hostname.2026-12-31.tar) restored using tar xvf pwd*tar.
Clipboard behaviour driven by environment variables: PWDSH_CLIP_CMD defaults to xclip and becomes pbcopy on macOS, PWDSH_CLIP_SEC clears the copy after 10 seconds, and PWDSH_CLIP_OUT selects clipboard or screen.
An opt-in Pepper: when PWDSH_PEPPER names a file, an extra string is generated and displayed once, appended to the storage passphrase and deliberately left out of backup archives.

Who uses it and how

Individuals keeping secrets on a personal workstation, symlinking pwd.sh into a directory on PATH and opening the store with their own passphrase.
Linux and macOS users relying on clipboard integration: xclip on Linux, pbcopy on macOS, with PWDSH_CLIP_ARG set to -i -selection clipboard for the primary selection.
Anyone rebuilding a lost machine, since ./pwd.sh b archives the store for backup and tar xvf pwd*tar restores it.
Users who want the store to stay usable without the script, because everything decrypts with GnuPG directly, and users who prefer hardware-backed access through drduh/Purse and its YubiKey integration instead of a passphrase.

Getting started

Download pwd.sh from GitHub Releases, clone the repository, or fetch the script directly with wget, then run ./pwd.sh or symlink it into a directory on PATH. The project is MIT-licensed, and recommended GnuPG options are published in config/gpg.conf.

How it compares

No list of paid products it replaces is given, so the nearest reference point in these facts is drduh/Purse, from the same author, which addresses the same problem by integrating with a YubiKey rather than a passphrase. GnuPG does the encryption in both cases; pwd.sh contributes storage layout, naming, revision history and backup.

When to use it — and when not to

A self-hoster must supply Bash, GnuPG and a storage directory, look after backups and remember the storage passphrase; if the optional Pepper is enabled, its file has to be kept separately because backups exclude it. It suits individuals rather than teams, since shared or server-side secret management, synchronisation between devices and per-user access control are not described, and it stores text secrets only.

project readme (upstream, from github) — read inline

pwd.sh is a Bash script to manage text secrets, such as passwords, using GnuPG.

Each secret is saved to a randomly-named file in a directory. An encrypted index maps usernames to secrets contained in files. Both the index and files can be decrypted directly with GnuPG - without pwd.sh.

Install

Download from Releases, or to use the latest version, clone the repository:

git clone https://github.com/drduh/pwd.sh

Or download the script directly:

wget https://raw.githubusercontent.com/drduh/pwd.sh/main/pwd.sh

Use

Run the script interactively using ./pwd.sh or symlink to a directory in PATH:

w - write (create) a secret
r - read (access) a secret
l - list secret names and paths
s - generate a random secret
u - generate a random username
b - archive materials for backup
v - print version information
h - print help text

Options can also be passed on the command line.

Create a 20-character secret for userName:

./pwd.sh w userName 20

Read secret for userName:

./pwd.sh r userName

Secrets are stored with an epoch timestamp for revision control and the most recent version is read by default. To list all secrets or read a specific version of a secret:

./pwd.sh l
./pwd.sh r userName@1574723600

Create a backup tar archive:

./pwd.sh b

Restore from backup:

tar xvf pwd*tar

Configuration

pwd.sh can be configured with environment variables as follows:

Variable	Description	Default	Available options
`PWDSH_STORE`	secret storage directory	`v4-pwd.sh.secret`	any valid string
`PWDSH_INDEX`	index file name	`v4-pwd.sh.index`	any valid string
`PWDSH_CLIP_CMD`	clipboard to use	`xclip`	`pbcopy` on macOS
`PWDSH_CLIP_ARG`	arguments to pass to clipboard command	unset (disabled)	`-i -selection clipboard` to use primary (control-v) clipboard with xclip
`PWDSH_CLIP_OUT`	secret output destination, will set to `screen` without clipboard	`clipboard`	`clipboard` or `screen`
`PWDSH_CLIP_SEC`	seconds to clear secret from clipboard/screen	`10`	any valid integer
`PWDSH_COPY`	copy secret to clipboard before write	unset (disabled)	`1` or `true` to enable
`PWDSH_COMMENT`	unencrypted comment to include in index and secret files	unset	any valid string
`PWDSH_ECHO`	character used to echo password input	`*`	any valid character
`PWDSH_LEN`	default secret length	`20`	any valid integer
`PWDSH_CHAR`	character set for secret	`A-Za-z0-9!@#$%^&*()_+`	any valid characters
`PWDSH_BACKUP_NAME`	backup archive file name	`v4-pwd.sh.hostname.2026-12-31.tar`	any valid string
`PWDSH_PEPPER`	file containing Pepper	unset (disabled)	any valid file path

See config/gpg.conf for recommended GnuPG options.

Also see drduh/Purse which integrates with YubiKey instead of using a passphrase to access secrets.

Pepper

The Pepper is an additional string appended to the storage passphrase to improve its strength. When the PWDSH_PEPPER option is set to a valid path, a secret value is generated and displayed once, then saved to the respective file.

The Pepper should be written down (for example, transcribed with passphrase.html or passphrase.txt template) and stored in a secure, durable location for backup.

This feature may enable use of a more memorable - and possibly weaker passphrase - for convenience, while still guarding backups against passphrase brute-force attempts (provided the Pepper is backed up separately).

The Pepper feature is opt-in and has no effect unless explicitly enabled.

[!IMPORTANT] The Pepper is not included in backup archives! Without the Pepper, secret storage will not be accessible with the passphrase alone!

Frequently asked questions

Is pwd.sh free to use?

pwd.sh is open source under the MIT licence. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does pwd.sh do?

Manage secrets with Bash and GnuPG symmetric encryption

What is pwd.sh written in?

pwd.sh is primarily written in Shell. Its source is publicly available at https://github.com/drduh/pwd.sh, and it has 1,563 GitHub stars.