# Mastering Pass on Ubuntu 24.04

## 🔐 Introduction

If you care about security, privacy, and full control over your password management, then [Pass](https://www.passwordstore.org/)—the Standard Unix Password Manager—is a serious contender. Paired with GPG encryption, OTP support, Git-based sync, and browser integration, it becomes a powerful solution for developers, sysadmins, and power users.

In this guide, we’ll walk you through setting up and mastering `pass` on **Ubuntu 24.04**, with a secure and synchronized workflow across all your machines.

---

## 🧰 Prerequisites

Make sure your system is up to date:

```bash
sudo apt update && sudo apt upgrade
```

Then install the required packages:

```bash
sudo apt install pass gnupg2 git xclip
```

For OTP support:

```bash
sudo apt install pass-otp
```

For Chrome integration:

```bash
pip install chrome-pass
```

> 🧪 *Python >= 3.6 is required for* `chrome-pass`*.*

---

## 🔑 Step 1: Create Your GPG Key

`pass` uses GPG to encrypt and decrypt your password files. Let’s create a key:

```bash
gpg --full-generate-key
```

Choose:

* **(1) RSA and RSA**
    
* **Key size**: 4096
    
* **Expire**: 2y (or your choice)
    
* Enter your **name**, **email**, and a **strong passphrase**
    

Then list your key:

```bash
gpg --list-keys
```

Copy the key ID (usually a 16-digit hex string).

---

## 🗂 Step 2: Initialize Your Password Store

```bash
pass init <your-gpg-key-id>
```

Example:

```bash
pass init 0123456789ABCDEF
```

Your password store is now set up at `~/.password-store/`.

---

## 🔐 Step 3: Storing and Retrieving Passwords

Respect the structure: `domain.com/username`

```bash
pass generate -c www.google.com/your_email@domain.com 16
```

This creates a new entry where:

* The **folder name** is the domain (e.g., `www.google.com`)
    
* The **file name** is the username (e.g., `your_email@domain.com`)
    
* The **password** is stored inside the file
    

To retrieve:

```bash
pass show www.google.com/your_email@domain.com
```

To copy to clipboard:

```bash
pass -c www.google.com/your_email@domain.com
```

This structure is **mandatory** for Chrome extension compatibility.

---

## 🔁 Step 4: Adding OTP Tokens

To append OTP token (without overwriting password):

```bash
pass otp append -e www.google.com/your_email@domain.com
```

Where `-e` echoes the OTP URI to the terminal so you can verify its content before it's appended to the entry.

To get the current token:

```bash
pass otp www.google.com/your_email@domain.com
```

> ⚠️ Always use `append` to avoid overwriting the password.

---

## 🌐 Step 5: Chrome Integration

Install the Chrome extension: 👉 [Chrome Pass](https://chromewebstore.google.com/detail/chrome-pass-zx2c4/oblajhnjmknenodebpekmkliopipoolo)

Start the client:

```bash
chrome_pass install
```

> ✅ Ensure your pass entries follow the structure `domain/username`. 🔒 The client runs a local WebSocket for the extension. Keep it local and ephemeral.

---

## 🌍 Step 6: Git Synchronization

`pass` includes built-in Git integration. To set it up correctly:

```bash
pass git init
pass git remote add origin git@github.com:johndoe/pass-store.git
pass git push -u --all
```

Once initialized, all Git-related operations are handled through `pass git`.

For example, after making changes (adding passwords, etc.):

```bash
pass git push
```

To retrieve updates on another machine:

```bash
pass git pull
```

You don’t need to use `commit` or `add`—`pass` manages that internally.

To clone your password store on a new machine:

```bash
git clone git@github.com:johndoe/pass-store.git ~/.password-store
pass init <your-gpg-key-id>
```

From there, you can use `pass` as usual.

---

## 🧳 Step 7: Sync Your GPG Key

Export your private key:

```bash
gpg --export-secret-keys --armor <your-key-id> > gpg-private-key.asc
```

Export your public key:

```bash
gpg --export --armor <your-key-id> > gpg-public-key.asc
```

Transfer securely (e.g., USB stick + Veracrypt) to your other machine, then import:

```bash
gpg --import gpg-public-key.asc
gpg --import gpg-private-key.asc
```

Trust the key:

```bash
gpg --edit-key <your-key-id>
> trust
> 5 (ultimate)
> quit
```

---

## 🧠 Best Practices

✅ Always use a **strong passphrase** for your GPG key  
✅ Back up your private key securely (offline storage or encrypted vault)  
✅ Use `pass git` to track and synchronize changes  
✅ Don’t sync your GPG key via Git — ever  
✅ Use SSH authentication with your Git remote  
✅ Rotate your GPG key every 1–2 years

---

## 🧩 Optional: Bonus Tools

* 🔄 [`syncthing`](https://syncthing.net/) for offline sync
    
* 📱 [Password Store Android](https://github.com/android-password-store/)
    
* 🔐 Yubikey + GPG Smartcard
    

---

## ✅ Conclusion

With `pass`, Ubuntu, GPG, OTP, Git, and browser integration, you have a password manager that is transparent, secure, and under your control. No more cloud-based black boxes—just clean Unix philosophy.

> Your passwords are only as safe as your habits. Encrypt, audit, sync wisely.

---

🧠 *Feel free to share or fork this guide to make your own secured setup easier for your team or friends.*