For Firefox there is https://addons.mozilla.org/en-US/firefox/addon/passff/ which I'm quite happy with.

When combined with a yubikey set to decrypt only on touch this setup has a very low attack surface compared to other browser password managers.

This used to be my approach, but it prevented grepping through my password store (you have to touch the yubikey to decrypt each password separately)

I since switched to a separate on-device key for "low value" passwords and keep the interesting stuff (e-mail pwds) under the yubikey protected key (which does requires touch).

Did you find a better solution?

No. But i don't have an need for mass access so the basic case works fine for me. I keep a backup key on a separate yubikey that does not require touch for key maintenance.

Apparently there is a new "cached" option for the touch settings "Touch is cached for 15s after use (valid from 4.3)." Which would work for your use case but also neglect some/most? of the security advantages.

Yup... also very happy with pass, with the addition of ansible's passwordstore plugin, qtpass, dpass and various other pass-addons. All my passwords are gpg-encrypted and versioned in git.

i love pass on GNU/linux but occasionally have to use OS X for a particular sponsor. the brew impl of pass using zsh does not seem to be autocompleting. i believe i have installed the correct autocompletions and mucked with .zshrc (.zshenv does not seem to be respected on OS X).

any recommendations for OS X? is it worth building from source and/or getting it working outside of brew?

I had the same issue at some point. I now have autocomplete working on my pass with .zshrc

From memory I think autocomplete worked for pass once I started using antigen.

I have the following plugins in my .zshrc plugins=( zsh-syntax-highlighting git iterm2 dotenv osx zsh-autosuggestions )

and also run antigen with user bundles for zsh-autosuggestions zsh-syntax-highlighting zsh-completions

Some magic somewhere in the above provided autocomplete for me with pass.

I hope it helps.

I really want pass or something like it, but the two times I've tried, I got stuck trying to figure out the gpg part. I suppose I should go and learn that properly anyways, since in spite of its UX it's still an extremely widely used and powerful tool, but it's a lot higher barrier to entry compared to "type in password, unlock vault".

The gist of it is that you need a keypair (a public and private key), which GPG can generate for you.

Then whenever you insert something into the `pass` database (which is just a directory tree full of encrypted plaintext files) the tool uses the public key to encrypt the password (or anything else):

    pass generate --no-symbols shopping/ebay 16

Later, when you want to read a password, you ask pass to decrypt the file using the private key from your keypair:

    pass shopping/ebay 16

The difficulty is really all in managing the keys, which can be quite a faff to set up and then manage. If you're only using gpg for `pass`, IMO it's easiest to copy the keypair (which gpg generated) to all your other machines.

A quick web search brought up a gist [0] which shows how to quickly get up and running on a single machine.

If you want to use it on another laptop/desktop/*nix-like machine you'll need to export both your public and private gpg keys and then import them on the other machine. When using a phone you have to do something similar. The Android clients were fairly straightforward, but Pass for iOS had a very, very clunky way of getting the keys across. Regardless, it boils down to this: get the gpg keypair on all of the devices and then get them all using the same git repo for pass.

[0]: https://gist.github.com/flbuddymooreiv/a4f24da7e0c3552942ff

Thank you:) That gist does look like what I need; I'll have to try it out!

I would recommend Keepass. There are a variety of clients available for lots of platforms.

I'm currently using keepassx(c) currently, actually:) That's mostly a good system for me, but I'm hitting some issues, mostly around syncing; syncthing is great, but it kinda sucks at taking care of conflicts, which pass (git) very much should manage nicely.

With the dmenu wrapper (passmenu) or something similar for rofi there is almost no need for a browser extension.

I assume this approach doesn't auto-fill forms?

Pass changed my life. I cannot recommend it highly enough!