A password store for machines that run agents. An agent asks for a secret, macOS raises a Touch ID prompt naming the agent and the secret, and the value goes into one child process rather than into the agent.
Secrets are ordinary age files. The broker decides who may open them. See docs/content/design.md for why it is built this way and what it costs.
It runs without an Apple Developer Program membership.
This is a new way to store passwords, a fingerprint releases one or more secrets into one process. It is young and may have bugs. Keep another copy of anything you cannot lose.
Documentation
- Install
- Design — Why passbox is built this way, and what each decision cost
- Use
- Plugins
- Backup and sync
- Unattended
- Another machine
- For agents — How an agent reads a secret without putting it in its context
- Reference
- Comparisons
- Roadmap — Not built and not committed to, written down so the reasoning survives
- Security
- Licence