https://github.com/cloudflare/gokey Skip to content Sign up * Product + Features + Mobile + Actions + Codespaces + Copilot + Packages + Security + Code review + Issues + Integrations + GitHub Sponsors + Customer stories * Team * Enterprise * Explore + Explore GitHub + Learn and contribute + Topics + Collections + Trending + Skills + GitHub Sponsors + Open source guides + Connect with others + The ReadME Project + Events + Community forum + GitHub Education + GitHub Stars program * Marketplace * Pricing + Plans + Compare plans + Contact Sales + Education [ ] * # In this repository All GitHub | Jump to | * No suggested jump to results * # In this repository All GitHub | Jump to | * # In this organization All GitHub | Jump to | * # In this repository All GitHub | Jump to | Sign in Sign up {{ message }} cloudflare / gokey Public * Notifications * Fork 58 * Star 770 A simple vaultless password manager in Go License BSD-3-Clause license 770 stars 58 forks Star Notifications * Code * Issues 3 * Pull requests 2 * Actions * Wiki * Security * Insights More * Code * Issues * Pull requests * Actions * Wiki * Security * Insights cloudflare/gokey This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository. master Switch branches/tags [ ] Branches Tags Could not load branches Nothing to show {{ refName }} default View all branches Could not load tags Nothing to show {{ refName }} default View all tags 1 branch 1 tag Code Latest commit @bdrung @ignatk bdrung and ignatk Wrap long lines in LICENSE and README.md ... 751c284 Mar 4, 2022 Wrap long lines in LICENSE and README.md Long lines are hard to read. Therefore wrap the long lines in `LICENSE` and `README.md` after 80 characters. Signed-off-by: Benjamin Drung 751c284 Git stats * 39 commits Files Permalink Failed to load latest commit information. Type Name Latest commit message Commit time cmd/gokey Add support for P-384, also known as secp384r1 Aug 9, 2021 rsa Add a test-case which tracks changes to the stdlib RSA key generation... Jan 3, 2019 .travis.yml Bump Travis Go version to 1.15 May 6, 2021 LICENSE Wrap long lines in LICENSE and README.md Mar 4, 2022 README.md Wrap long lines in LICENSE and README.md Mar 4, 2022 csprng.go Switch Fortuna with stream cipher. Nov 21, 2016 csprng_test.go Remove unused imports from csprng_test.go Nov 21, 2016 go.mod Update dependencies (go get -u) May 6, 2021 go.sum Update dependencies (go get -u) May 6, 2021 gokey.1.md Add support for P-384, also known as secp384r1 Aug 9, 2021 gokey.go Add support for x25519(curve25519) and ed25519 private keys Jun 15, 2018 gokey_test.go Add support for P-384, also known as secp384r1 Aug 9, 2021 keygen.go Add support for P-384, also known as secp384r1 Aug 9, 2021 keygen_test.go Initial release Oct 27, 2016 keytype_string.go Add support for P-384, also known as secp384r1 Aug 9, 2021 View code [ ] gokey A simple vaultless password manager in Go example options Installation Modes of operation Simple mode (without a seed file) Using a seed file README.md gokey Build Status Go Report Card A simple vaultless password manager in Go gokey is a password manager, which does not require a password vault. Instead of storing your passwords in a vault it derives your password on the fly from your master password and supplied realm string (for example, resource URL). This way you do not have to manage, backup or sync your password vault (or trust its management to a third party) as your passwords are available immediately anywhere. example gokey -p super-secret-master-password -r example.com options * -o - by default gokey outputs generated data to stdout * -P - path to master password file which will be used to generate other passwords/keys or to encrypt seed file (see Modes of operation below, if no master password or master password file is provided, gokey will ask for it interactively) * -p - master password which will be used to generate other passwords/keys or to encrypt seed file (see Modes of operation below, if no master password or master password file is provided, gokey will ask for it interactively) * -r - any string which identifies requested password/key, most likely key usage or resource URL * -s - needed, if you want to use seed file instead of master password as an entropy source (see Modes of operation below); can be generated with -t seed flag as described below * -skip - number of bytes to skip when reading seed file * -u - UNSAFE, allow generating keys without using a seed file (see Modes of operation below) * -t - requested password/key output type * -l - number of characters in the generated password or number of bytes in the generated raw stream (default 10 for "pass" type and 32 for "raw" type) Supported password/key types: * pass - default, generates a password * seed - generates a seed file, which can be used with -s option later * raw - generates 32 random bytes (can be used as a symmetric key) * ec256 - generates ECC P-256 private key * ec384 - generates ECC P-384 private key * ec521 - generates ECC P-521 private key * rsa2048 - generates 2048-bit RSA private key * rsa4096 - generates 4096-bit RSA private key * x25519 - generates x25519 (also known as curve25519) ECC private key * ed25519 - generates ed25519 ECC private key Installation gokey command-line utility can be downloaded and compiled using standard go get approach. Assuming you have Go installed and $GOPATH set, just do go get github.com/cloudflare/gokey/cmd/gokey The gokey binary should appear in your $GOPATH/bin directory. Modes of operation gokey can generate passwords and cryptographic private keys (ECC and RSA keys are currently supported). However, without any additional options specified it uses your master password as a single source of entropy for generated data. For passwords it is acceptable most of the time, but keys usually have much higher entropy requirements. For cases, where higher entropy is required for generated passwords/ keys, gokey can use a seed file (a blob with random data) instead of the master password as a source of entropy. Simple mode (without a seed file) In simple mode passwords are derived directly from your master password and the realm string. That is each unique combination of a master password and a realm string will produce a unique password. For example, if your master password is super-secret-master-password and you want to generate a password for example.com, you would invoke gokey like gokey -p super-secret-master-password -r example.com If you need a password for a different resource, (example2.com), you would change the real string gokey -p super-secret-master-password -r example2.com This way you need to remember only your master password and you can always recreate passwords for your services/resources. NOTE: In this mode generated passwords are as strong as your master password, so do have your master password strong enough. You can also derive private keys from your master password, but keep in mind, that these keys will have low entropy. That is why it is considered unsafe, so gokey does not allow it by default. If you're really know what you are doing, you can override this default by supplying -u flag. Using a seed file If you plan to generate not only passwords, but also private keys or you want to have your passwords/keys with higher entropy, you can use a seed file instead of the master password. You still need to supply a master password, when invoking gokey, but it will be used only to protect the seed file itself; all generated passwords/keys will be derived from the data in the seed file. gokey uses seed files protected (encrypted) with your master password, so it is reasonably safe to store/backup seed files to a third party location, such as Google Drive or Dropbox. To generate an encrypted seed file, use gokey -p super-secret-master-password -t seed -o seedfile This will create a seed file seedfile with 256 bytes of random data. The data is encrypted using AES-256-GCM mode and super-secret-master-password as a key. Then, to generate EC-256 private key for example.com, use gokey -p super-secret-master-password -s seedfile -r example.com -t ec256 NOTE: you still need to remember your master password and keep a backup copy of your seed file. If you forget your master password or loose your seed file, you loose all derived passwords/keys as well. About A simple vaultless password manager in Go Topics ecc password-generator password-manager keychain seed stateless password-vault ed25519 deterministic password-store key-generator rsa-key Resources Readme License BSD-3-Clause license Code of conduct Code of conduct Stars 770 stars Watchers 16 watching Forks 58 forks Releases 1 First tagged release Latest Jul 8, 2019 Packages 0 No packages published Used by 14 * @DavidGOrtega * @iterative * @bitmaelum * @bitmaelum * @bitmaelum * @bitmaelum * @bitmaelum + 6 Contributors 10 * @ignatk * @bdrung * @Bren2010 * @wardn * @frebib * @levidurfee * @gliptak * @dncohen * @anthonyfok * @awnumar Languages * Go 100.0% Footer (c) 2022 GitHub, Inc. Footer navigation * Terms * Privacy * Security * Status * Docs * Contact GitHub * Pricing * API * Training * Blog * About You can't perform that action at this time. You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session.