Uses new Rust 2021
|0.3.0||May 26, 2022|
|0.2.3||Feb 17, 2022|
|0.2.1||Dec 21, 2021|
|0.1.1||Sep 20, 2021|
#158 in Cryptography
Napa is a simple command line password manager written in Rust and based on libsodium. Napa should be considered alpha-level: it should not be used to store any actual passwords, and the database format may change in the future. At the moment Napa is Linux-only and requires
wl-clipboard for clipboard support. Patches for other FOSS operating systems are welcome.
The easiest way to install Napa is through Cargo:
cargo install napa
Once Napa matures support will be added for other package managers.
The most popular command line password manager today is probably pass, which I used happily for several years. However, pass uses GPG to encrypt its secrets, which requires the song-and-dance of maintaining a GPG key just to access your passwords. GPG is also bad, and its aging cryptography means that pass is vulnerable to the database attacks described here. Pass also gives arbitrary programs read/write access to your passwords once your GPG key is unlocked, which made me increasingly nervous in today's age of typosquatting. Thus was born Napa, a much simpler password manager with stronger cryptography for when you don't completely trust your local computer.
A new database can be initialized using
napa init. This will generate a six word passphrase from the EFF long word list. Remember this passphrase, since it won't be displayed again.
$ napa init my-passwords.napa The new passphrase for this database file is: creme-customer-squad-persuader-wise-purveyor Remember this passphrase! It will not be displayed again.
After initialization, the database file can be unlocked using
napa open. This will cache the decryption key in memory and drop you into a REPL-like interface for editing the password entries.
$ napa open my-passwords.napa Enter the passphrase: > edit example-entry # this will open the entry in $EDITOR
The name of each password entry can be arbitrary text, which allows you to group the passwords however you like. Password entries can also contain arbitrary text and have no pre-defined layout. The only exception is for lines starting with the special
password: prefixes. When present, these prefixes are used when generating a new password or copying it to the clipboard. For example:
domain: login.example.com, login.example.co.uk username: my-username password: my-awesome-password Any extra information down here.
The complete set of available commands can be seen by running
help in the REPL. Each command also has documentation that can be accessed using
Finally, the passphrase to the database file can be changed with the
napa pass command. This will generate a new passphrase.
$ napa pass my-passwords.napa Enter the passphrase: Your new passphrase for this database file is: penalty-cement-legacy-surface-symphonic-confound Remember this passphrase! It will not be displayed again.
The Napa database file is designed to be immune to specific attacks described in the database document. Once the database is unlocked, Napa makes a best-effort attempt to avoid exposing secret material to any external process. For example, all memory allocated during the program is zeroed on deallocation. Secret information can only be accessed by the rest of the system when:
- copying to the clipboard (somewhat unavoidable, but the clipboard is cleared after a single paste), and
- editing entries with the
$EDITOR(which uses temporary files, though file creation follows best practices).
When possible, Napa should be compiled as a statically-linked binary to prevent LD_PRELOAD attacks. Of course, this won't extend to the rest of your system (such as your terminal emulator), so it is recommended to use a sandbox (like bubblewrap) and a mandatory access control system such as SELinux or AppArmor.
Commits and tags that I author are signed with my GPG key1. After importing the key, they can be verified using
git verify-commit and
Napa is licensed under the MPL2.
Napa took inspiration from several other cryptographic programs, including:
- GPG is still bad, but unfortunately it's the only tool you can use to sign Git commits.