Skip to content
Search

Gokey

lastmod 2025-11-25created 2025-11-252 edits

A lightweight password manager that "computes" passwords without any storage

About

  • A password manager that needs no password store (vault); it combines a master password + realm string to generate the same password on the fly every time
  • Given the same input, the same password can be reproduced on any device, so the problems of backup, sync, and 3rd-party trust disappear entirely
  • Supports generating many types of keys beyond simple passwords: ECC/RSA keys, raw byte streams, seed files, etc.
  • For cases that need strong entropy, it can create an encrypted seed file and use it for high-strength key generation (encrypted with AES-256-GCM)
  • A CLI-centric tool; combine -p, -r, -t, etc. to reproduce anything from URL-based login passwords to x25519 and ed25519 keys
  • Output goes to stdout by default; the -o option saves it to a file
  • Supported output types
    • pass: generates a regular password
    • seed: generates an encrypted seed file
    • raw: generates a 32-byte random stream
    • ec256, ec384, ec521: generates an ECC private key
    • rsa2048, rsa4096: generates an RSA private key
    • x25519, ed25519: generates a Curve25519-based ECC key
  • 2 operating modes
    • Simple mode: generates a derived password from just the master password and realm string
      • Produces a unique result for each combination; no separate storage needed
      • However, the security level depends on the strength of the master password
    • Seed file mode: uses a seed file as the entropy source for higher security
      • The seed file is encrypted with AES-256-GCM, so it can be safely backed up to external storage (e.g. Google Drive, Dropbox)
      • The master password is used only to protect the seed file
  • A CLI utility written in Go; install with go install github.com/cloudflare/gokey/cmd/gokey@latest
  • Open source developed by Cloudflare

See also

Favorite site

author Zer0 sitemap