gopass is a password manager for teams, built on GPG and Git. It's a descendant of pass and adds several features, including interactive search and multiple password stores in a single tree. Since we first mentioned gopass, our teams have used it on several projects, sometimes stretching it beyond its limits. A sorely missed feature was the ability to deprecate secrets. Discoverability was already an issue, but not being able to mark secrets as no longer in use compounded this problem. The biggest issue, though, was scale. When you have teams with 50+ people using the same repository for several years, we found that the repository could grow to multiple gigabytes in size. Re-encrypting the secrets when onboarding new members could take more than half an hour. The underlying issue seems to be that in our teams everything changes all the time: people come and go, secrets are rotated, the architecture evolves, new secrets are added, old ones are no longer needed. gopass seems to work well, even for large numbers of users, when there's less change.
gopass is a password management solution for teams, built on GPG and Git. It's a descendant of pass and adds features such as: support for recipient management and multiple password stores in a single tree; an interactive search functionality; time-based one-time password (TOTP) support; and storage of binary data. Migration of your pass store is fairly straightforward, because gopass is largely compatible with the format pass uses. This also means integration into provisioning workflows can be achieved with a single call to a stored secret.
gopass is a password management solution for teams, built on GPG and Git. It's a descendant of pass and adds features such as: support for recipient management and multiple password stores in a single tree; an interactive search functionality; time-based one-time password (TOTP) support; and storage of binary data. Migration of your pass store is fairly straightforward, because gopass is largely compatible with the format pass uses. This also means integration into provisioning workflows can be achieved with a single call to a stored secret.
