It stays encrypted at rest on your machine protected by GPG keys and when you want to access a password you can choose to copy it to your clipboard for 45 seconds or print it to stdout.
No subscription services, and everything stays local on your machine, but you can easily sync it to other devices using whatever file syncing service you want since it's just encrypted files on disk.
Will be looking into this to replace a KeePass DB!
But you have to ask yourself. Who are you protecting against here? Are people browsing around your laptop / workstation without you monitoring what they're doing?
If someone has your machine without your consent, then you're pretty much screwed because 99.99999% of people will leave themselves logged into things like gmail which requires no password to access it once the machine is powered on. It's basically this xkcd scenario: https://xkcd.com/1200/
Nope - but the industry that I work in constantly assumes "bad actors" are present. Although it's not perfect - everything is 2FA, all disks on laptops encrypted, there are strict rules in dealing with secrets/sensitive information, etc. My main concern is if someone were able to do a rip of my home directory.
Trust me - there's a TON of room for improvement, but doing some general protection against someone with "shell" access is something I'm in the practice of... it's the same reason I carefully manage what ends up in my .zsh_history or .bash_history =)
> If someone has your machine without your consent, then you're pretty much screwed
Agreed. Encrypt the disk (I trust LUKS), lock your machine when not in-use, ensure it shuts itself down if a password is "fat-fingered" more than twice, use solid passwords with good complexity, use 2FA when you can/should, etc.
Then you can choose to either type it in every time you unlock a password or cache it for your session (depends on how important security is for you).
Personally I cache it for my session. This way I only need to type in my pass phrase once when I power on the machine.
The best part about the pass utility is that it piggy backs off GPG for its encryption mechanism.
A quick Google shows this: https://github.com/drduh/YubiKey-Guide
I didn't read everything but it seems pretty comprehensive.