Beta — core read/write is stable; some rough edges remain. See the changelog ↗
Free & Open Source · MIT License
Your passwords. Local. Yours.Built on pass + gpg.
Ichtaca wraps the standard Unix pass CLI and gpg/gpg-agent, giving you a richer interface over your existing ~/.password-store — zero migration, zero new format, zero cloud.
MIT License No telemetry Built on pass + gpg macOS & Linux No cloud, ever
ichtaca
$ ichtaca list
web/github
web/example.com
email/work
dev/api-key
$ ichtaca get web/github | pbcopy
$ ichtaca otp email/work
482 031
$ ichtaca doctor
pass: ok
gpg: ok
store: ok (~/.password-store)
$
Three ways to use it
One store. Every interface.
All three share the same passcore Rust library and the same ~/.password-store — pick the interface that fits the moment.
Terminal TUI
ichtaca
Full-featured keyboard-driven UI in your terminal. Tree browser, fuzzy search, masked passwords, live TOTP, create/edit/delete — all without leaving the command line.
$ ichtaca # opens interactive TUI
Desktop GUI
ichtaca-desktop
Native desktop app (Tauri + Svelte). The same entry tree and detail panel in a window — suited for those who prefer GUI over terminal. Strict CSP; plaintext stays in the Rust backend.
$ open /Applications/Ichtaca.app # or: ICHTACA_DEMO=1 ichtaca-desktop
Scriptable CLI
ichtaca <subcommand>
Non-interactive subcommands for scripting and automation. Pipe-safe output, machine-readable JSON, stable exit codes. list · get · set · search · otp · copy · generate · show · doctor.
$ ichtaca get web/github | pbcopy $ ichtaca show web/gh --json | jq . $ ichtaca generate dev/key --length 32
See it in action
Obsidiana & Oro
The same dark gold-accented palette across TUI and desktop.
Every feature is available in both the TUI and the desktop app, sharing the same passcore Rust library.
Tree browser
Navigate your store directory tree with vim keys (hjkl) or arrows. Expand folders, select entries.
Masked by default, reveal on demand
Passwords are hidden until you explicitly press s (TUI) or click Reveal (desktop). Fields and tags always visible.
Live TOTP / OTP
Generate and copy one-time codes directly from otpauth:// URIs stored in entries — no separate authenticator app needed.
Copy & auto-clear
Copies the password via pass; clipboard is auto-cleared after 45 s (configurable), but only if the clipboard still holds your value.
Fuzzy search
Live search across all entry paths. Press Ctrl-f for content search — decrypts entries to match inside bodies and tags.
Create · edit · delete
Form-based with templates, user-defined fields, and tags. Or raw $EDITOR edit for full control. Delete removes from the store.
CSPRNG password generator
OS-backed secure random generator; rejection-sampled to avoid modulo bias. Configurable length and character set (symbols optional).
Scriptable CLI
Nine subcommands for automation: list, get, set, search, otp, copy, generate, show --json, doctor. Stable exit codes.
How it stacks up
Honest comparison
Ichtaca sits between bare pass (minimal UI) and cloud managers (privacy trade-offs). Here is an accurate picture.
Feature
Ichtaca TUI + Desktop + CLI
pass alone bare CLI
Cloud managers e.g. 1Password, Bitwarden
Local-first — data stays on your machine
✓
✓
✗
No cloud sync required
✓
✓
✗
No telemetry / no network calls
✓
✓
✗
You own and control the encryption keys
✓
✓
–
Open source (MIT / GPL)
✓
✓
–
Rich UI — tree, masked reveal, forms, tags
✓
✗
✓
Native desktop app
✓
✗
✓
Live TOTP in the UI
✓
✗
✓
Scriptable CLI with stable exit codes
✓
✓
–
Works with your existing ~/.password-store
✓
✓
✗
Cloud managers marked "–" for key ownership: some offer zero-knowledge models, but you depend on their service and key management. Open source column: Bitwarden is partially open source; 1Password is proprietary.
Security posture
Secrets off disk. Out of logs.
Ichtaca delegates all encryption to gpg/gpg-agent via pass. It adds defense-in-depth on top.
GPG delegation
Decryption is performed by gpg/gpg-agent via the pass CLI. Ichtaca never writes decrypted data to disk and never sees your raw private key.
In-memory zeroization
Sensitive values are held in a Secret type that is zeroized on drop (via the zeroize crate). They are redacted in Debug output — they cannot leak into logs or error messages.
Masked by default
Passwords are hidden in both apps. Reveal only on an explicit user action — s in the TUI, the Reveal button in the desktop. No accidental shoulder-surf exposure.
Clipboard auto-clear
After a clipboard copy, a background thread clears it after 45 s (configurable). The clear is conditional: if the value has since changed — because you copied something else — it is left untouched.
Desktop: plaintext in Rust only
IPC commands that handle secrets (copy_password, otp_code) do the work in the backend and return nothing sensitive to the webview. A strict Content Security Policy — no remote scripts, no remote URLs.
No telemetry. No network.
Ichtaca makes no outbound connections. The only network activity possible is git push/pull if your store uses git — handled entirely by pass git and your own git config.
macOS, unsigned beta: the .dmg/.app is not yet code-signed or notarized — macOS Gatekeeper will block it on first launch. To open it: Right-click (or Control-click) the app → Open → Open (only needed once), or run xattr -dr com.apple.quarantine /Applications/Ichtaca.app. Signing and notarization are planned for the post-beta release.
Common questions
FAQ
Is it really free?
Yes — completely. Ichtaca is released under the MIT License. No paid tier, no subscription, no feature gating. The source code is on GitHub.
Do I need pass already installed?
Yes. Ichtaca wraps pass and gpg/gpg-agent — it does not replace them. You need both installed and a GPG key configured. Run ichtaca doctor to check your setup.
If you are starting from scratch: install pass and gpg, run gpg --full-generate-key, then pass init <your-gpg-key-id>. See the Docs for a step-by-step guide.
Are my passwords ever stored in the cloud?
No — not by Ichtaca. Your encrypted .gpg files live in ~/.password-store (or wherever PASSWORD_STORE_DIR points) on your machine. Ichtaca makes no network connections whatsoever.
The only way your store touches a network is if you configure pass git to sync via a git remote — which is entirely your choice and handled by your own git configuration.
Is it production-ready?
Honest answer: the core read/write functionality is stable and has been in regular use. But this is a beta with known rough edges:
• The macOS desktop build is unsigned — Gatekeeper will warn on first launch. • There is no structured TOTP editor yet (you add OTP URIs via the raw editor). • Documentation is still being written. • Breaking changes may happen before a stable release.
We recommend always keeping a backup of your ~/.password-store and GPG keys when running pre-release software.
How is Ichtaca different from gopass or browserpass?
gopass is a full pass-compatible CLI replacement with team features. Ichtaca is a UI layer on top of standard pass — it does not replace pass itself.
browserpass is a browser extension for filling credentials in web forms. Ichtaca is focused on the terminal and desktop UX, not browser autofill.
The main Ichtaca differentiator: a keyboard-driven TUI, a native desktop GUI, and a scriptable CLI — all sharing the same passcore library and your existing store. No new data format, no server, no extension required.
Why is the macOS app unsigned?
Code-signing and notarization for macOS requires an Apple Developer ID ($99/year). We plan to add this post-beta once the build is more stable. In the meantime, you can bypass Gatekeeper with a right-click → Open, or by running xattr -dr com.apple.quarantine /Applications/Ichtaca.app.
The TUI binary (ichtaca) is not affected — it runs directly from the terminal without Gatekeeper restrictions.
