Mastering Pass on Ubuntu 24.04

🔐 Introduction

If you care about security, privacy, and full control over your password management, then Pass—the Standard Unix Password Manager—is a serious contender. Paired with GPG encryption, OTP support, Git-based sync, and browser integration, it becomes a powerful solution for developers, sysadmins, and power users.

In this guide, we’ll walk you through setting up and mastering pass on Ubuntu 24.04, with a secure and synchronized workflow across all your machines.

---

🧰 Prerequisites

Make sure your system is up to date:

sudo apt update && sudo apt upgrade

Then install the required packages:

sudo apt install pass gnupg2 git xclip

For OTP support:

sudo apt install pass-otp

For Chrome integration:

pip install chrome-pass

🧪 Python >= 3.6 is required for chrome-pass.

---

🔑 Step 1: Create Your GPG Key

pass uses GPG to encrypt and decrypt your password files. Let’s create a key:

gpg --full-generate-key

Choose:

• (1) RSA and RSA

• Key size: 4096

• Expire: 2y (or your choice)

• Enter your name, email, and a strong passphrase

Then list your key:

gpg --list-keys

Copy the key ID (usually a 16-digit hex string).

---

🗂 Step 2: Initialize Your Password Store

pass init <your-gpg-key-id>

Example:

pass init 0123456789ABCDEF

Your password store is now set up at ~/.password-store/.

---

🔐 Step 3: Storing and Retrieving Passwords

Respect the structure: domain.com/username

pass generate -c www.google.com/your_email@domain.com 16

This creates a new entry where:

• The folder name is the domain (e.g., www.google.com)

• The file name is the username (e.g., your_email@domain.com)

• The password is stored inside the file

To retrieve:

pass show www.google.com/your_email@domain.com

To copy to clipboard:

pass -c www.google.com/your_email@domain.com

This structure is mandatory for Chrome extension compatibility.

---

🔁 Step 4: Adding OTP Tokens

To append OTP token (without overwriting password):

pass otp append -e www.google.com/your_email@domain.com

Where -e echoes the OTP URI to the terminal so you can verify its content before it's appended to the entry.

To get the current token:

pass otp www.google.com/your_email@domain.com

⚠️ Always use append to avoid overwriting the password.

---

🌐 Step 5: Chrome Integration

Install the Chrome extension: 👉 Chrome Pass

Start the client:

chrome_pass install

✅ Ensure your pass entries follow the structure domain/username. 🔒 The client runs a local WebSocket for the extension. Keep it local and ephemeral.

---

🌍 Step 6: Git Synchronization

pass includes built-in Git integration. To set it up correctly:

pass git init
pass git remote add origin git@github.com:johndoe/pass-store.git
pass git push -u --all

Once initialized, all Git-related operations are handled through pass git.

For example, after making changes (adding passwords, etc.):

pass git push

To retrieve updates on another machine:

pass git pull

You don’t need to use commit or add—pass manages that internally.

To clone your password store on a new machine:

git clone git@github.com:johndoe/pass-store.git ~/.password-store
pass init <your-gpg-key-id>

From there, you can use pass as usual.

---

🧳 Step 7: Sync Your GPG Key

Export your private key:

gpg --export-secret-keys --armor <your-key-id> > gpg-private-key.asc

Export your public key:

gpg --export --armor <your-key-id> > gpg-public-key.asc

Transfer securely (e.g., USB stick + Veracrypt) to your other machine, then import:

gpg --import gpg-public-key.asc
gpg --import gpg-private-key.asc

Trust the key:

gpg --edit-key <your-key-id>
> trust
> 5 (ultimate)
> quit

---

🧠 Best Practices

✅ Always use a strong passphrase for your GPG key
✅ Back up your private key securely (offline storage or encrypted vault)
✅ Use pass git to track and synchronize changes
✅ Don’t sync your GPG key via Git — ever
✅ Use SSH authentication with your Git remote
✅ Rotate your GPG key every 1–2 years

---

🧩 Optional: Bonus Tools

• 🔄 syncthing for offline sync

• 📱 Password Store Android

• 🔐 Yubikey + GPG Smartcard

---

✅ Conclusion

With pass, Ubuntu, GPG, OTP, Git, and browser integration, you have a password manager that is transparent, secure, and under your control. No more cloud-based black boxes—just clean Unix philosophy.

Your passwords are only as safe as your habits. Encrypt, audit, sync wisely.

---

🧠 Feel free to share or fork this guide to make your own secured setup easier for your team or friends.