The 'pass' password manager uses gpg keys.


However, gpg itself can be used for symmetric encryption of files. Does pass only work using public/private keys, or is it possible to use with symmetric encryption?

  • pass just store(output, change, generate new ones, etc.) your text passwords in encripted storage in key:value form secured by master-pass. To receive some stored pass you should call pass with key and input master-pass for decription.
    – Costas
    Commented Mar 3, 2015 at 13:18
  • "To receive some stored pass you should call 'pass' with 'key' and input master-pass for decription." -- I'm afraid I don't understand. Could you give an example?
    – SauceCode
    Commented Mar 3, 2015 at 13:28
  • For example you have stored some pass with key private_mail (to list stored keys call pass without args). When you execute pass private_mail you'll be prompted to enter master-pass and if it true outputs the pass for private_mail
    – Costas
    Commented Mar 3, 2015 at 14:16
  • I think it can only use a pair of keys. Why would you prefer symmetric encryption ?
    – Leiaz
    Commented Mar 3, 2015 at 14:28
  • @Costas: I see, but then public key encryption is being used under the hood, so far as I understand.
    – SauceCode
    Commented Mar 3, 2015 at 14:37

1 Answer 1


The pass password manager requires a public key for encrypting its files (where the managed passwords are stored) - and it requires a private key to decrypt its files.

It isn't possible to configure pass to use gpg's 'pure' symmetric file encryption (cf. the -c or --symmetric GPG options).

This is due to the design of pass - using GPG's public key cryptography for file encryption/decryption allows for flexibility, e.g. for configuring multiple keys - say - such that a group of users has access to the managed passwords.

Also note that GPG uses a hybrid scheme when encrypting a file for one or many recipients (i.e. using one or many public keys): it randomly generates a session key for the symmetric encryption of the file and then just uses the public key/keys to encrypt the session key.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .