Password manager

Passwords

fd0 pass is the password manager. An item is a title, a set of URLs, an optional note, and typed fields. It is stored like every other fd0 record, so a login is shared, synced, and revoked exactly the way a secret or an SSH key is — through its scope.

Field types

text
Plain values shown as-is: usernames, account ids, backup addresses.
secret
Masked in output. Reveal or copy it explicitly.
totp
An otpauth:// URI. fd0 prints or copies the current code.
passkey
Passkey material stored as data, so it syncs and shares with the item.
file
A small attached file — a recovery key, a certificate.
section
A named group. Fields under it use a slash path, like Recovery/code-1.

Create an item

$ fd0 pass add github --url https://github.com --scope work
$ fd0 pass field set github username ada@example.com
$ fd0 pass field set github password --secret --generate --length 32
$ fd0 pass totp add github "otpauth://totp/GitHub:ada@example.com?secret=..."

--generate creates the value without it ever appearing in your shell history. To pass a value you already have without recording it either, use - and pipe it in: fd0 pass field set github password - --secret.

fd0 pass add <name> [--url URL] [--notes TEXT] [--scope <scope>]

Create an item. Repeat --url for several matching URLs. The command refuses an existing name; --force replaces the whole record rather than merging.

fd0 pass field set <name> <path> [value] [--secret|--type text|secret|passkey] [--generate] [--length N]

Set one field. The path is a plain name, or section/name for a field inside a section.

fd0 pass section add <name> <path>

Add a section so related fields can be grouped under one path.

fd0 pass totp add <name> <otpauth-uri> [--field <path>]

Store a TOTP URI. It lands in the totp field unless you name another one.

fd0 pass file add <name> <file> [<path>] [--mime <type>]

Attach a small file as a field. The field takes the file's basename unless you give a path.

fd0 pass edit <name> [--title <title>] [--url <url>]

Change the title or replace the URL list. Fields are edited with pass field set.

Read it back

$ fd0 pass                         # interactive browser
$ fd0 pass github                  # browser, pre-filtered
$ fd0 pass copy github             # password to the clipboard, auto-cleared
$ fd0 pass totp code github
$ fd0 pass show github             # secrets masked
$ fd0 pass list --json

Bare fd0 pass opens the interactive browser; it needs a terminal, and it tells you to use pass list or pass show when there is not one. Secrets stay masked in the browser until you use the shortcut it shows you.

fd0 pass show <name> [--reveal] [--json]

Print one item. Secrets are masked; --reveal prints them, --json prints the decrypted item.

fd0 pass copy <name> [<field>] [--clear-after 30s]

Copy a field to the clipboard and clear it again. Without a field it copies the password; on a TOTP field it copies the current code.

fd0 pass field get <name> <path> [--raw]

Print one field value to stdout. --raw drops the trailing newline, which is what scripts want.

fd0 pass find [<query>] [--url <url>] [--json]

Match items by title or URL. --url is the browser-and-autofill lookup.

fd0 pass file export <name> <path> [--out <file>]

Write an attached file back to disk. It refuses to overwrite unless you pass --force.

fd0 pass notes show|set|rm <name>

Read, replace, or remove the item's free-text note.

fd0 pass generate [--length 32] [--raw]

Generate a password without storing anything.

Everything else is the shared grammar

pass takes the same verbs as every other module — list, rename, move, rm, and history. See the CLI reference for the full set.

$ fd0 pass rename github github-work
$ fd0 pass move github --to-scope personal
$ fd0 pass history show github
$ fd0 pass history restore github 3
$ fd0 pass rm github
Prefer fd0 pass copy over --reveal for passwords and TOTP codes. Reveal, field get, and file export put plaintext where your terminal, your history, and your logs can see it.
← Previous
CLI reference
Next →
SSH