macOS
Homebrewverified · 100%
brew install gokeylocal Homebrew formula metadata
MacPortsverified · 94%
sudo port install gokeyMacPorts ports tree · security/gokey/Portfile · source: api.github.com
brew
Install gokey with Homebrew, apt, MacPorts, Nix
Simple vaultless password manager in Go. Version 0.2.1 via Homebrew; verified from local package data.
install
Additional install commands
Linux
Debian aptverified · 92%
sudo apt install gokeyDebian stable package indexes · gokey · source: deb.debian.org
Nixverified · 92%
nix profile install nixpkgs#gokeynixpkgs package indexes · pkgs/by-name/go/gokey/package.nix · source: api.github.com
overview
Package summary
Simple vaultless password manager in Go
Project links
Commands and aliases
- gokey
history
Project history and usage
gokey is Cloudflare's vaultless password manager written in Go. Instead of storing passwords in a vault, it derives passwords and keys from a master password plus a realm string, with optional encrypted seed-file mode for higher-entropy material.
The project sits in the deterministic-password-manager family: the user keeps a master secret and recreates site-specific outputs rather than synchronizing a password database.
Project history
The repository begins in October 2016 with an initial release. The README describes simple password derivation, seed-file mode, and support for output types including passwords, raw bytes, ECC keys, RSA keys, x25519, and ed25519.
Early history focused on random-generation internals and command behavior. Later history includes release-binary automation, dependency updates, imported deterministic key-generation logic from Go's crypto packages, and seed unwrap testing.
Adoption history
gokey's adoption is mostly that of a compact security utility: it is useful to users who do not want to store, back up, or synchronize a password vault. The README emphasizes that generated passwords are available wherever the user can provide the same master password and realm.
The input package facts list Homebrew, Debian, MacPorts, Nix, and Ubuntu package names, which indicates distribution through both macOS-focused and Linux distribution channels.
How it is used
In simple mode, a user runs gokey with a master password and a realm such as a resource URL. Changing the realm derives a different output while keeping the same master password.
For higher-entropy passwords or private keys, the README documents seed-file mode: generate an encrypted seed file, protect it with the master password, and derive passwords or keys from the seed plus realm. Seed paths are command inputs rather than a fixed credentials-file location.
Why package nerds care
gokey matters to package nerds because it is a small, auditable-feeling security CLI with no vault service, database daemon, or sync dependency. Its packaging footprint is a single Go command, but its security model lives in deterministic derivation choices.
It is also a useful contrast with mainstream password managers: packaging the tool is easy, while the hard part is documenting the operational warning that losing the master password or seed file loses the derived outputs.
Timeline
- 2016: Repository begins with an initial release.
- 2016: Early commits change random-generation internals and output conditioning.
- 2022: Release-binary publishing through GitHub Actions is added.
- 2023: Deterministic key-generation logic from Go crypto packages is imported.
- 2026: v0.2.1 tag appears with public KeyGen RNG member work.
Related projects
- Go's crypto packages are related through key-generation behavior referenced in repository history.
- Deterministic password managers are the broader tool family; gokey's distinguishing feature is combining password and private-key derivation in a Go CLI.
- Cloudflare is the upstream organization that publishes the repository.
Sources
security posture
Risk level: green
narrow executable package without higher-risk signals.
Risk classifier
green risk · low confidence · appliance
Why
- narrow executable package without higher-risk signals
Signals
- metadata:no-higher-risk-signals
Install behavior
- No Homebrew post-install hook is recorded in formula metadata.
- Homebrew bottle metadata is available for 6 platform targets.
- Build metadata lists 2 build dependencies.
Recommended review
Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.
executables
Installed executables
| Command | Kind | Exposure | Note |
|---|---|---|---|
gokey | cli | global executable |
freshness
Version and freshness
These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.
page generated2026-07-08
manager version0.2.1
manager updated
local dataok
upstreamcurrent
latest detectedv0.2.1
https://github.com/cloudflare/gokey
- infoNo package-manager update timestamp was available.low confidence
install metadata
Package metadata
| Package key | brew:gokey |
|---|---|
| Version | 0.2.1 |
| Package manager | Homebrew |
| Package manager page | https://formulae.brew.sh/formula/gokey |
| Homepage | https://github.com/cloudflare/gokey |
| Repository | https://github.com/cloudflare/gokey |
| Upstream docs | https://github.com/cloudflare/gokey#readme |
| License | BSD-3-Clause |
| Source archive | https://github.com/cloudflare/gokey/archive/refs/tags/v0.2.1.tar.gz |
| Build dependencies | go, go-md2man |
| Bottle | available (on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux) |
| Homebrew post-install | not defined |
| Service | none declared |
registry facts
Source database details
| Source Database | Homebrew formula API |
|---|---|
| Tap | homebrew/core |
| Full Name | gokey |
| Version Scheme | 0 |
| Revision | 0 |
| Head Version | HEAD |
| Bottle Stable Root URL | https://ghcr.io/v2/homebrew/core |
| Deprecated | no |
| Disabled | no |
| Keg Only | no |
| URL Keys |
|
source database matches
Other package-manager records
Matches are pulled from external package-manager indexes and kept separate from local Automic Vault package links.
Debian apt95%
gokey 0.1.2-1+b13
simple vaultless password manager in Go
https://github.com/cloudflare/gokey
sudo apt install gokey- Section: utils
- Architecture: amd64
- Source Package: gokey
- 1 dependencies
- normalized package name match
- Matched by: Gokey
Debian apt95%
golang-github-cloudflare-gokey-dev 0.1.2-1
simple vaultless password manager in Go - dev package
https://github.com/cloudflare/gokey
sudo apt install golang-github-cloudflare-gokey-dev- Section: golang
- Architecture: all
- Source Package: gokey
- 2 dependencies
- normalized package name match
- Matched by: Gokey
Nix95%
gokey
nix profile install nixpkgs#gokey- normalized package name match
- Matched by: Gokey
Ubuntu apt95%
gokey 0.1.2-1build1
simple vaultless password manager in Go
https://github.com/cloudflare/gokey
sudo apt install gokey- Section: universe/utils
- Architecture: amd64
- 1 dependencies
- normalized package name match
- Matched by: Gokey
Ubuntu apt95%
golang-github-cloudflare-gokey-dev 0.1.2-1build1
simple vaultless password manager in Go - dev package
https://github.com/cloudflare/gokey
sudo apt install golang-github-cloudflare-gokey-dev- Section: universe/devel
- Architecture: all
- Source Package: gokey
- 2 dependencies
- normalized package name match
- Matched by: Gokey
MacPorts95%
gokey
sudo port install gokey- normalized package name match
- Matched by: Gokey
source trail
Generated from repository data
This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.
Combined YAML source
View the package source record on GitHub.
Used sources
- Geiger risk classifier
- Nucleus package database
- av.db category and tag curation
- cross-ecosystem install command graph
- curated package history
- external package-manager database matches
- package relationship graph
- package version freshness
- package-page enrichment