Pass Unlock Daemon

Small dialog that asks for your GPG passphrase once a day and caches it in gpg-agent.

packages/pass-unlock

Pass Unlock is a small always-on-top window, not a background daemon. It asks for your GPG passphrase and hands it to gpg-agent, so tools that call pass do not each prompt for it.

What it does

  1. On start it checks whether the store exists (~/.password-store/.gpg-id) and whether gpg-agent already has a cached key. If the unlock time recorded today is still valid, it shows “Pass is unlocked for today” and the time.
  2. Otherwise it shows a greeting and a passphrase field. Click Unlock for Today (or press Enter) and it runs gpg-preset-passphrase --preset <keygrip> for every secret key in your keyring. A wrong passphrase shows an error and nothing is cached.
  3. On success it writes the Unix time to ~/.cache/robos/pass-unlock-time, appends <timestamp>|user|unlock|<daily-unlock> to ~/.cache/robos/pass-access.log, and closes after a few seconds.
  4. Skip - remind me later quits without unlocking.

The dialog also shows counts of secret accesses (total, by agent and by user) read from ~/.cache/robos/pass-access.log for the current date. In this repository only Pass Unlock itself writes to that file, and only for the unlock event.

Requirements

  • gpg and /usr/lib/gnupg/gpg-preset-passphrase.
  • allow-preset-passphrase in ~/.gnupg/gpg-agent.conf. Pass Manager and Security Setup Wizard write this setting when they create keys; confirm for your own key.

Pass Manager opens this dialog when its header badge shows Locked. Its Lock button clears the cache and posts a notification that links back here. A second launch of Pass Unlock focuses the existing window.

Related guides

More in Security & Credentials

DocuVault Desktop Offline-first secure markdown notes, personal snippet vault, and local workstation storage starter app. Git Login Manager Checks that GitHub access works (gh login, SSH key, SSH connection, git identity) and walks you through fixing what fails. Pass Manager Vault Desktop front end for the standard Unix password store (pass), with entries encrypted by GPG. RobOS Setup Wizard Eleven-step first-run wizard for GPG, pass, pinentry, git identity, SSH, Chrome, GitHub login, AI agent keys and optional tools. RobOS VPN Sandbox Launch any desktop or CLI app inside an isolated Linux network namespace (ip netns) routed exclusively through OpenVPN with a 3-barrier kernel kill-switch. RobOS VPN Servers Manage OpenVPN providers (IPVanish built-in with 3,598 server profiles), encrypted VPN accounts, live TLS 1.3 credential tests, and server locations. Security Setup Wizard Five-step wizard that configures GPG pinentry, a GPG key, the pass store and an SSH key.