&gt; Downside of pass is that the filenames are in the open.<p>The &quot;entry&quot; names (which I think would correspond to filenames in `pass`) appear to be passed on the command line here; they&#x27;ll likely get swept up in your shell&#x27;s history file, unless you&#x27;re careful. (And thus, are essentially in the open, just like pass.) That said, I think most shells make their histfiles 600, so they&#x27;re not directly readable. (And I think `pass`&#x27;s directory is 700, similarly.) And you have to trust the machine you&#x27;re running on, of course; otherwise, I can just dump the memory as soon as your keyring is decrypted.<p>I think it was when `pass` was on HN that I mentioned this; I have a terminal keyring manager myself[1], but one of the design decisions I made in it (aside from a single-file archive) was to not pass entry names on the command line, specifically so they won&#x27;t get swept up in histfiles. It&#x27;s easy, though, it make it optional, and let the user decide what they want to do. Of course, your<p>[1] which is way not ready to be looked at… also seems like we as a crowd enjoy this topic (keyrings) as a side project.