gopass

gopass is a command-line password manager for teams that need to share credentials across a distributed group, multiple devices, or a fully offline air-gapped machine. It is a drop-in replacement for pass, the standard UNIX password manager, and works the same way across Linux, macOS, BSD, and Windows with no network connectivity unless you add it.

By default it encrypts credentials with GPG and versions them in git, so every change is auditable and your store can be cloned, pushed, and synced like any repository. You can switch encryption to age, change storage backends including fossil, or opt out of versioning with a filesystem store. The command line is the primary interface for CLI users, CI/CD, and automation.

gopass runs on infrastructure you control, with no hosted service, since your store is just GPG-encrypted files in a git repository you own. The full source is under the MIT license, and installation is offered through package managers like Homebrew.