$Getting started with go password manager·August 2, 2026

Getting started with Go password manager

GPG Cheatsheet

gopass command	explaination
`gopass list <password-store>`	list the password store in tree format where leaves are encrypted passwords
`gopass show <path-to-leaf-node>`	Decrypts the encrypted value stored at the specified path of the password store. Requires the passphrase to be entered before doing this
`gopass -c <path-to-leaf-node`	Copies to clipboard instead of displaying
`gpg --list-secret-keys`	List secret keys in gpg
`gpg --list-keys`	List public keys in gpg
`gpg --list-secret-keys --keyid-format=long`	Get the id of the private key
`gopass fsck --decrypt`	The most comprehensive way to ensure all files are correctly encrypted for all recipients is to run a file system check (`fsck`) with the decryption/re-encryption flag.
`gpg --list-secret-keys --keyid-format=long`
`gopass mounts unmount <store-name>`	unmounts the repo from gopass but doesn't delete the cloned repo
`gpg --armor --export <your-email> > yourname.pub.asc`	Export public GPG key
`gpg --import <public-key>`	Either ends with `.pub.asc` or `.gpg`
`gopass recipients add --store <password-store>`	Add the gpg public key to password-store
`gpg --delete-key <UID-of-the-key>`	Delete public key from GPG
`gpg --delete-secret-key <UID-of-the-key>`	Delete private key from gpg

A wants to share a secret with B then follow below steps

1. Get B's public key (B.pub.asc)
   gpg --import B.pub.asc
  
2. Now A should encrypt the file to be shared using B's public key.
   gpg --encrypt --sign --armor -r B@email.com <secret-file> 
   //👆🏽 This generates a file with .asc extension and this needs to be shared with B.
 
3. Now B needs to decrypt the file sent by A
   gpg --decrypt <encypted_file>

Steps to generate gopass keys

   gpg --generate-key 
   // 👆🏽 This command prompts for user name, email, and passphrase. Make sure that the email you use is linked to GitHub account.

View your gpg key
   gpg --list-secret-keys

Export gpg key
   gpg --armor --export  <your-email>  > yourname.pub.asc

Add recipient to gopass

This command needs to be run by person who has the access to gopass gpg --import <B.gpg>gpg --list-keysgopass recipients add --store aquanar // choose the gpg key of user B from the listgopass sync

Notes

If you are troubleshooting and want to confirm if a specific private key can decrypt the file, you can bypass gopass and use the GPG command directly, forcing it to try one of your keys:

gpg --try-secret-key <Key-ID> --decrypt ~/.password-store/path/to/your/secret.gpg

Replace <Key-ID> with the ID of one of your private keys. If the decryption works, you know that key is a valid recipient.

Remove gopass store

if the gopass is already mounted unmount using gopass mounts remove aquanar_password_store
To mount password store onto gopass use gopass mounts add aquanar /c/Code/aquanar_password_store/

Remove user from gopass

gopass recipients # you will get users key  
gopass recipients rm <key-id> #paste key of the user you want to remove  
gopass sync #will sync with remote

Troubleshooting

In case you observe gopass.exe working on git bash but not gopass. The simplest way to solve this problem is to create a file called gopass in /usr/bin/ and add the following lines in that file

#!/bin/bash
gopass.exe "$@"

How the gpg key exchange happens

image here