#cli #cryptography #password-manager

app napa

A simple and secure command line password manager

7 releases

Uses new Rust 2021

0.3.0 May 26, 2022
0.2.3 Feb 17, 2022
0.2.1 Dec 21, 2021
0.1.1 Sep 20, 2021

#158 in Cryptography

MPL-2.0 license

11K SLoC

crates.io license dependency status builds.sr.ht status


Napa is a simple command line password manager written in Rust and based on libsodium. Napa should be considered alpha-level: it should not be used to store any actual passwords, and the database format may change in the future. At the moment Napa is Linux-only and requires wl-clipboard for clipboard support. Patches for other FOSS operating systems are welcome.


The easiest way to install Napa is through Cargo:

cargo install napa

Once Napa matures support will be added for other package managers.


The most popular command line password manager today is probably pass, which I used happily for several years. However, pass uses GPG to encrypt its secrets, which requires the song-and-dance of maintaining a GPG key just to access your passwords. GPG is also bad, and its aging cryptography means that pass is vulnerable to the database attacks described here. Pass also gives arbitrary programs read/write access to your passwords once your GPG key is unlocked, which made me increasingly nervous in today's age of typosquatting. Thus was born Napa, a much simpler password manager with stronger cryptography for when you don't completely trust your local computer.


A new database can be initialized using napa init. This will generate a six word passphrase from the EFF long word list. Remember this passphrase, since it won't be displayed again.

$ napa init my-passwords.napa
The new passphrase for this database file is: creme-customer-squad-persuader-wise-purveyor
Remember this passphrase! It will not be displayed again.

After initialization, the database file can be unlocked using napa open. This will cache the decryption key in memory and drop you into a REPL-like interface for editing the password entries.

$ napa open my-passwords.napa
Enter the passphrase:
> edit example-entry
# this will open the entry in $EDITOR

The name of each password entry can be arbitrary text, which allows you to group the passwords however you like. Password entries can also contain arbitrary text and have no pre-defined layout. The only exception is for lines starting with the special domain:, username:, and password: prefixes. When present, these prefixes are used when generating a new password or copying it to the clipboard. For example:

domain: login.example.com, login.example.co.uk
username: my-username
password: my-awesome-password

Any extra information down here.

The complete set of available commands can be seen by running help in the REPL. Each command also has documentation that can be accessed using --help, e.g. edit --help.

Finally, the passphrase to the database file can be changed with the napa pass command. This will generate a new passphrase.

$ napa pass my-passwords.napa
Enter the passphrase:
Your new passphrase for this database file is: penalty-cement-legacy-surface-symphonic-confound
Remember this passphrase! It will not be displayed again.


The Napa database file is designed to be immune to specific attacks described in the database document. Once the database is unlocked, Napa makes a best-effort attempt to avoid exposing secret material to any external process. For example, all memory allocated during the program is zeroed on deallocation. Secret information can only be accessed by the rest of the system when:

  • copying to the clipboard (somewhat unavoidable, but the clipboard is cleared after a single paste), and
  • editing entries with the $EDITOR (which uses temporary files, though file creation follows best practices).

When possible, Napa should be compiled as a statically-linked binary to prevent LD_PRELOAD attacks. Of course, this won't extend to the rest of your system (such as your terminal emulator), so it is recommended to use a sandbox (like bubblewrap) and a mandatory access control system such as SELinux or AppArmor.

Commits and tags that I author are signed with my GPG key1. After importing the key, they can be verified using git verify-commit and git verify-tag.


Napa is licensed under the MPL2.


Napa took inspiration from several other cryptographic programs, including:

  1. GPG is still bad, but unfortunately it's the only tool you can use to sign Git commits.


~276K SLoC