PKPass: Public Key Based Password Manager
RTD
https://pkpass.readthedocs.io/en/latest/
Requires >= Python 3.6
Overview
This is a basic password store and password manager for maintaining arbitrary secrets.
The password management solution provides:
- Encryption at Rest
- Password distribution/organization based on definable hierarchies
- Password creation timestamps
- Password history and change logs
- Distributed backup capabilities
- PIV/Smartcard Credential encryption/decryption
- Import and export functionality
Passwords that are created are distributed to recipients by public key encryption. The x509 certificate of the intended recipient is used to create an encrypted copy of the distributed password that is then saved in a password-specific git repository. Multiple encrypted copies of the secret are created, one for each user. End users then check out the git repo and are able to read passwords using their PIV/Smartcard credential to decrypt.
Install
Everything:
pip install pkpass-olcf
MacOs:
brew install olcf/tap/pkpass
x509 Certificate Repository
PKPass needs a trusted x509 certificate repository, which typically is managed using git. Certificates in this repository should all be signed by Certificate Authorities that can be found in the CABundle file that PKPass is configured to look at. Since this repository should be considered 'trusted', it is typically managed by a smaller trusted set of site administrators. PKPass validates all encryption certificates as they are used to make sure they are signed by a trusted Certificate Authority (CA).
You may also use a local x509 certificate repository that you sync with others using RSYNC, NFS, shared volumes, etc. You can configure the directory that pkpass will use for the certificate repository either on the command line, or through the .pkpassrc file.
The CABundle file to use can also be configured in the .pkpassrc file or on the command line.
Additionally, certificates should be named .cert. For example, the certificate for user 'jason' should be named 'jason.cert' inside this x509 directory.
Password Repository
PKPass also needs a directory to serve as a 'password database'. Like the x509 certificate repository, it is also typically managed with git to provide change control, history, and tracking of changes. Local directories can also be used and shared via rsync, NFS, shared volumes, etc if preferred.
To change the default password repository, you may specify another directory on the command line or in the .pkpassrc file.
3 maintainers
Release files for pkpass-olcf 2.9.6
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| pkpass_olcf-2.9.6.tar.gz | 69.8 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| pkpass_olcf-2.9.6-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 139.5 kB
Release files / pkpass_olcf-2.9.6.tar.gz
| Download URL | pkpass_olcf-2.9.6.tar.gz |
|---|---|
| Size | 69.8 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
9f79991409571b94dd4bf6f97094043610a5574a77e9e0847d59eef92ea2b17c
|
|
BLAKE2b-256 checksum How to use checksums |
b610d4d3e13588618627624be022be367ab5a7eb851b5ffa289345cba538a4dd
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.12
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on May 11, 2026.
Transparency logRelease files / pkpass_olcf-2.9.6-py3-none-any.whl
| Download URL | pkpass_olcf-2.9.6-py3-none-any.whl |
|---|---|
| Size | 69.7 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
33f7295320f917f659f0235d84e933bbd5d2dff5328ada2bc5c0ccd85276abaf
|
|
BLAKE2b-256 checksum How to use checksums |
8a5597da29e6d5bc74db28cc65c5abe1aef7eb1f7fabfc2d49099179ba6f78b8
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.12
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on May 11, 2026.
Transparency log
