pass uses GnuPG to handle encryption.
Recent releases of GnuPG uses a GPG daemon.
This GPG daemon caches your valid authentication for 600 seconds (
default-cache-ttl), which may be refreshed to another 600 seconds if you use GnuPG again within that time, up to a maximum of two hours (
You have two options:
Kill the GPG agent process after each use of
pass. You do this with
gpgconf --kill gpg-agent
Configure the "cache max time to live" for the GPG agent (the maximum time a valid authentication is remembered, by default two hours).
This number may be changed by changing the GPG daemon's configuration file.
You do this by adding the following line to your
~/.gnupg/gpg-agent.conf file (you may have to create this file):
If a GPG agent is currently running, then make sure to terminate it with the
gpgconf command as shown above to ensure that the agent reads the updated configuration file when it is started.
See also the
gpg-agent manual, specifically the documentation for the
--max-cache-ttl option (which corresponds to the
max-cache-ttl configuration setting). The manual also mentions the
gpgpconf --kill gpg-agent command.