[opensourcedex]

QtPass is a free, open source identity & access management (iam) project written in C++ and released under GPL-3.0. It has 1,150 GitHub stars, 172 forks and 6 open issues, and was last pushed 5 hours ago. On this registry it ranks #44 of 67 tracked projects in Identity & Access Management (IAM), with 5 head-to-head comparisons available.

What is QtPass?

QtPass is a multi-platform graphical front end for pass, the standard Unix password manager, aimed at people who want to manage encrypted credentials with GPG without living in a terminal.

What it is

QtPass is a C++ desktop application built on Qt6 that presents pass, the standard Unix password manager, through a native graphical interface. Rather than maintaining its own vault format, it drives pass and git alongside gpg2 directly, so the underlying store remains plain GPG-encrypted files organised in directories. It runs on Linux, BSD, macOS and Windows, uses native widgets and iconography where the platform allows it, and is translated into over 60 languages.

The problem it solves is that pass is powerful but command-line-only, which makes features such as multi-recipient folder encryption, per-folder user selection, and Git synchronised stores awkward for people who are not comfortable at a shell prompt, and awkward to hand to a team. QtPass exposes those operations as dialogs and menus — including the process output panel with command labels and colour-coded errors — so the same encrypted store that works from the terminal works from a window, with onboarding for new users.

Key capabilities

  • Uses pass or git and gpg2 directly rather than a private storage layer, including Git integration for version control of the store.
  • Provides built-in TOTP (One-Time Password) support with no external extension required.
  • Supports per-folder user selection for multi-recipient encryption, plus a Share submenu to re-encrypt a folder, export your public key, and add recipients.
  • Generates passwords with configurable complexity, and searches across decrypted entries using regular expressions as an opt-in feature.
  • Works with smartcards and USB tokens over OpenPGP, including YubiKey, and imports GPG keys from a file or from the clipboard without leaving the app.
  • Maintains multiple profiles at once, and offers configurable shoulder-surfing protection.
  • Shows a process output panel with command labels, colour-coded errors, and auto-scroll.

Who uses it and how

  • Linux, BSD, macOS and Windows users who already keep a pass store and want the same encrypted files available through a graphical interface on each platform.
  • Small teams sharing credentials through a Git remote, relying on per-folder recipient selection to encrypt a directory to several public keys.
  • Users whose keys live on a smartcard or YubiKey, who unlock and read entries through OpenPGP hardware rather than a passphrase on disk.
  • People who need TOTP codes alongside stored passwords and prefer a single application for both.
  • Contributors and translators, working against an actively maintained codebase with six open issues and a last push dated 11 October 2026.

Getting started

Install it from your platform's package manager — apt-get install qtpass on Debian and Ubuntu, dnf install qtpass on Fedora, pacman -S qtpass on Arch, pkg install qtpass on FreeBSD, choco install qtpass or winget install IJHack.QtPass on Windows — and complete first-time GnuPG and pass setup as described at qtpass.org/getting-starting.

How it compares

The facts provided for this entry name no comparable alternatives, so QtPass stands alone in this registry.

When to use it — and when not to

You must be able to operate GnuPG and pass yourself, including initial key and store setup, and on macOS you will need to download the .dmg from the releases page and clear the quarantine flag, because the Homebrew cask was disabled in September 2026 while the app remains unnotarized. It is the wrong choice if you want a hosted or self-hosted web service, a proprietary vault format, or a product that manages key setup for you — and the macOS packaging friction is a real limitation until notarization is resolved.

project readme (upstream, from github) — read inline

QtPass

GitHub release Packaging status latest packaged version(s)

Build and test CodeFactor

Coverage Status codecov

FOSSA Status REUSE status OpenSSF Best Practices OpenSSF Scorecard Translation status

QtPass is a multi-platform GUI for pass, the standard Unix password manager, providing a secure and intuitive way to manage your passwords.

Available in over 60 languages

Project site: qtpass.org — downloads, getting started, FAQ and screenshots.

Features

  • Using pass or git and gpg2 directly
  • Cross platform: Linux, BSD, macOS and Windows
  • Native widgets and iconography where possible
  • Per-folder user selection for multi-recipient encryption
  • Multiple profiles support
  • Built-in TOTP (One-Time Password) support, no external extension needed
  • Password generation with configurable complexity
  • Content search across decrypted entries (regular expression; opt-in)
  • Git integration for version control
  • Smartcard and USB token support (OpenPGP, YubiKey)
  • Configurable shoulder surfing protection
  • Share submenu: re-encrypt folder, export your public key, add recipients
  • Import GPG keys from file or clipboard without leaving the app
  • Process output panel with command labels, color-coded errors, and auto-scroll
  • Easy onboarding for new users

How each of these works, from profiles and templates to OTP and Git sync, is described on qtpass.org/advanced.

Logo based on Heart-padlock by AnonMoos.

Installation

Every way to install QtPass, with the current version per platform, is on qtpass.org/downloads; first-time setup of GnuPG and pass is on qtpass.org/getting-started.

From package

OpenSUSE & Fedora yum install qtpass dnf install qtpass

Debian, Ubuntu and derivates like Mint, Kali & Raspbian apt-get install qtpass

Arch Linux pacman -S qtpass

Gentoo emerge -atv qtpass

Sabayon equo install qtpass

FreeBSD pkg install qtpass

OpenBSD pkg_add qtpass

macOS Download the .dmg from the releases page and clear the quarantine flag: xattr -d com.apple.quarantine /Applications/QtPass.app (the Homebrew cask was disabled in September 2026 because the app is not notarized — see the macOS page on qtpass.org and #1542)

Windows choco install qtpass or winget install IJHack.QtPass (the installer is not code-signed yet, so SmartScreen asks for More info → Run anyway on first start; signing is being set up, see the code signing policy)

Linux (AppImage) Download QtPass--x86_64.AppImage from the releases page, then: chmod +x QtPass-*.AppImage && ./QtPass-*.AppImage It bundles Qt only, and uses the pass, gpg2, git and gpg-agent already installed on your system — so your existing ~/.password-store, pinentry and smartcard all keep working, with no sandbox permissions to grant. Requires glibc 2.39 or newer (Ubuntu 24.04+, Debian 13+, Fedora 40+) and libfuse2 (or run it with --appimage-extract-and-run on systems without it).

Packaging status Translation status

From Source

Dependencies
  • QtPass requires Qt 6.8 or later (build with qmake6); Qt 5 support ended with QtPass 1.8
  • The Linguist package is required to compile translations
  • For fallback icons, the SVG library is required

Runtime dependencies:

  • gpg2 (GnuPG 2.2+) - required
  • git - optional, for repository sync
  • pass (1.7+) - optional, can use native GPG/Git

Your GPG must be configured with a graphical pinentry when applicable. Same goes for Git authentication. On macOS, pinentry-mac from Homebrew works best (gpgtools also works).

On most Unix systems all you need is:

qmake6 && make && make install

Windows

See Windows.md for Windows-specific installation and build instructions.

Using profiles

Profiles allow grouping passwords. Each profile might use a different Git repository and/or different gpg key. Each profile also can be associated with a GPG key to sign and verify the .gpg-id file for integrity. A typical use case is to separate personal and work passwords.

Hint
Instead of using different git repositories for the various profiles passwords could be synchronized with different branches from the same repository. Just clone the repository into the profile folders and checkout the related branch.

Example

The following commands set up two profile folders:

cd ~/.password-store/
# Replace these with your own repositories (HTTPS or SSH).
PERSONAL_REPO_URL="<your-personal-password-repository-url>"
WORK_REPO_URL="<your-work-password-repository-url>"

# Examples:
# git clone https://git.example.com/you/qtpass-personal.git personal
# git clone git@git.example.com:you/qtpass-work.git work

git clone "${PERSONAL_REPO_URL}" personal && echo "personal/" >> .gitignore
git clone "${WORK_REPO_URL}" work && echo "work/" >> .gitignore
pass init -p personal [personal GnuPG-ID] && git -C personal push
pass init -p work [work GnuPG-ID] && git -C work push

Note:

  • Replace PERSONAL_REPO_URL and WORK_REPO_URL with repositories you own and control.
  • Replace [personal GnuPG-ID] and [work GnuPG-ID] with the ID from the related GnuPG key.
  • The parts echo ... >> .gitignore are just needed in case there is a Git repository present in the base directory.

Once the repositories and GnuPG-ID's have been defined the profiles can be set up in QtPass.

Links of interest

Testing

This is done with make check

Codecoverage can be done with make lcov, make gcov, make coveralls and/or make codecov.

Be sure to first run: make distclean && qmake6 CONFIG+=coverage qtpass.pro

Security considerations

The threat model and how to report a vulnerability are on qtpass.org/security and in SECURITY.md.

Using this program will not magically keep your passwords secure against compromised computers even if you use it in combination with a smartcard.

It does protect future and changed passwords though against anyone with access to your password store only but not your keys. Used with a smartcard it also protects against anyone just monitoring/copying all files/keystrokes on that machine and such an attacker would only gain access to the passwords you actually use. Once you plug in your smartcard and enter your PIN (or due to CVE-2015-3298 even without your PIN) all your passwords available to the machine can be decrypted by it, if there is malicious software targeted specifically against it installed (or at least one that knows how to use a smartcard).

To get better protection when using a smartcard even against a targeted attack I can think of at least two options:

  • The smartcard must require explicit confirmation for each decryption operation. Or if it just provides a counter for decrypted data you could at least notice an attack afterwards, though at quite some effort on your part.
  • Use a different smartcard for each (group of) key.

Known issues

  • Filtering (searching) breaks the tree/model sometimes
  • Starting without a correctly set password-store folder gives weird results in the tree view

Planned features

  • Plugins based on field name, plugins follow same format as password files
  • Colour coding folders (possibly disabling folders you can't decrypt)
  • Optional table view of decrypted folder contents
  • Opening of (basic auth) URLs in default browser? Possibly with helper plugin for filling out forms?
  • Some other form of remote storage that allows for accountability / auditing (web API to retrieve the .gpg files?)

Further reading

FAQ and CONTRIBUTING documentation. CHANGELOG

On qtpass.org: getting started, features in depth, FAQ, screenshots, security, privacy, code signing policy and changelog.

Source code Issue queue

AI assistance
Parts of QtPass are developed with AI coding assistants — mainly Claude Code, earlier also OpenCode — and AI reviewers (CodeRabbit, GitHub Copilot) comment on pull requests. Commits made with an assistant carry a Co-Authored-By: trailer naming the model (or the pull request says so), so the history shows which changes were AI-assisted. Every change is reviewed, built and tested by a human maintainer before it is merged, and the maintainers take responsibility for it. Some translations are machine-drafted; they stay marked unfinished in the .ts files until a native speaker confirms them on Weblate. The application itself contains no AI features and talks to no AI service.

License

This repository follows the REUSE Specification v3.2. Please see LICENSES/, REUSE.toml and the individual *.license files (if any) for copyright and license information.

GNU General Public License v3.0

GNU GPL v3.0

View official GNU site

OSI-approved license

View the Open Source Initiative site

Frequently asked questions

Is QtPass free to use?

QtPass is open source under the GPL-3.0 licence. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does QtPass do?

QtPass is a multi-platform GUI for pass, the standard unix password manager.

What is QtPass written in?

QtPass is primarily written in C++. Its source is publicly available at https://github.com/IJHack/QtPass, and it has 1,150 GitHub stars.