# Install gokey with Homebrew, apt, MacPorts, Nix Simple vaultless password manager in Go. Version 0.2.1 via Homebrew; verified from local package data. ## Install ```sh sudo av install brew:gokey ``` Additional install commands: ### macOS - Homebrew (100%): ```sh brew install gokey ``` Evidence: local Homebrew formula metadata - MacPorts (94%): ```sh sudo port install gokey ``` Evidence: MacPorts ports tree: security/gokey/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1 ### Linux - Debian apt (92%): ```sh sudo apt install gokey ``` Evidence: Debian stable package indexes: gokey from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz - Nix (92%): ```sh nix profile install nixpkgs#gokey ``` Evidence: nixpkgs package indexes: pkgs/by-name/go/gokey/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 ## Package facts - **Package key:** brew:gokey - **Package manager:** Homebrew - **Package manager page:** - **Version:** 0.2.1 - **Source summary:** Simple vaultless password manager in Go - **Homepage:** - **Repository:** - **Upstream docs:** - **License:** BSD-3-Clause - **Source archive:** - **Generated:** 2026-07-08T18:08:21+00:00 ## Executables - gokey (cli) - gokey (alias) ## Build dependencies - go - go-md2man ## Install behavior - Post-install hook: not defined - Bottle: available on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux ## Freshness - Page generated: 2026-07-08 - Package-manager version: 0.2.1 - Local data: ok - Upstream repository: https://github.com/cloudflare/gokey - Upstream latest detected: v0.2.1 (current) - info: No package-manager update timestamp was available. ## Project history and usage gokey is Cloudflare's vaultless password manager written in Go. Instead of storing passwords in a vault, it derives passwords and keys from a master password plus a realm string, with optional encrypted seed-file mode for higher-entropy material. The project sits in the deterministic-password-manager family: the user keeps a master secret and recreates site-specific outputs rather than synchronizing a password database. ### Project history The repository begins in October 2016 with an initial release. The README describes simple password derivation, seed-file mode, and support for output types including passwords, raw bytes, ECC keys, RSA keys, x25519, and ed25519. Early history focused on random-generation internals and command behavior. Later history includes release-binary automation, dependency updates, imported deterministic key-generation logic from Go's crypto packages, and seed unwrap testing. ### Adoption history gokey's adoption is mostly that of a compact security utility: it is useful to users who do not want to store, back up, or synchronize a password vault. The README emphasizes that generated passwords are available wherever the user can provide the same master password and realm. The input package facts list Homebrew, Debian, MacPorts, Nix, and Ubuntu package names, which indicates distribution through both macOS-focused and Linux distribution channels. ### How it is used In simple mode, a user runs gokey with a master password and a realm such as a resource URL. Changing the realm derives a different output while keeping the same master password. For higher-entropy passwords or private keys, the README documents seed-file mode: generate an encrypted seed file, protect it with the master password, and derive passwords or keys from the seed plus realm. Seed paths are command inputs rather than a fixed credentials-file location. ### Why package nerds care gokey matters to package nerds because it is a small, auditable-feeling security CLI with no vault service, database daemon, or sync dependency. Its packaging footprint is a single Go command, but its security model lives in deterministic derivation choices. It is also a useful contrast with mainstream password managers: packaging the tool is easy, while the hard part is documenting the operational warning that losing the master password or seed file loses the derived outputs. ### Timeline - 2016: Repository begins with an initial release. - 2016: Early commits change random-generation internals and output conditioning. - 2022: Release-binary publishing through GitHub Actions is added. - 2023: Deterministic key-generation logic from Go crypto packages is imported. - 2026: v0.2.1 tag appears with public KeyGen RNG member work. ### Related projects - Go's crypto packages are related through key-generation behavior referenced in repository history. - Deterministic password managers are the broader tool family; gokey's distinguishing feature is combining password and private-key derivation in a Go CLI. - Cloudflare is the upstream organization that publishes the repository. ### Sources - - - ## Security Notes narrow executable package without higher-risk signals. - **Geiger risk:** green / low - narrow executable package without higher-risk signals ## Source Database Details - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** gokey - **Version Scheme:** 0 - **Revision:** 0 - **Head Version:** HEAD - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** head, stable ## Other Package-Manager Records - Debian apt - gokey - 0.1.2-1+b13: normalized package name match | Debian stable package indexes: gokey from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | simple vaultless password manager in Go | https://github.com/cloudflare/gokey - Debian apt - golang-github-cloudflare-gokey-dev - 0.1.2-1: normalized package name match | Debian stable package indexes: golang-github-cloudflare-gokey-dev from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | simple vaultless password manager in Go - dev package | https://github.com/cloudflare/gokey - Nix - gokey: normalized package name match | nixpkgs package indexes: pkgs/by-name/go/gokey/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - Ubuntu apt - gokey - 0.1.2-1build1: normalized package name match | Ubuntu 24.04 LTS package indexes: gokey from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | simple vaultless password manager in Go | https://github.com/cloudflare/gokey - Ubuntu apt - golang-github-cloudflare-gokey-dev - 0.1.2-1build1: normalized package name match | Ubuntu 24.04 LTS package indexes: golang-github-cloudflare-gokey-dev from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | simple vaultless password manager in Go - dev package | https://github.com/cloudflare/gokey - MacPorts - gokey: normalized package name match | MacPorts ports tree: security/gokey/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1 ## Related links - [Cloud CLI packages](https://www.automicvault.com/pkg/cloud-clis/) - Belongs to a cloud or infrastructure command family. - [Source-control packages](https://www.automicvault.com/pkg/source-control-tools/) - Belongs to a source-control command family. - [Terminal utility packages](https://www.automicvault.com/pkg/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Language runtime packages](https://www.automicvault.com/pkg/language-runtime-packages/) - Matched language runtime, compiler, or interpreter metadata. - [go](https://www.automicvault.com/pkg/brew/go/) - Build dependency declared by Homebrew. - [go-md2man](https://www.automicvault.com/pkg/brew/go-md2man/) - Build dependency declared by Homebrew. - [clipsafe](https://www.automicvault.com/pkg/brew/clipsafe/) - Shares av.db curated category or tags: cli, password-management, password-manager, security. - [enpass-cli](https://www.automicvault.com/pkg/brew/enpass-cli/) - Shares av.db curated category or tags: cli, go, password-management, password-manager, security. - [go-passbolt-cli](https://www.automicvault.com/pkg/brew/go-passbolt-cli/) - Shares av.db curated category or tags: cli, password-management, password-manager, security. - [prs](https://www.automicvault.com/pkg/brew/prs/) - Shares av.db curated category or tags: cli, password-management, password-manager, security. - [pwsafe](https://www.automicvault.com/pkg/brew/pwsafe/) - Shares av.db curated category or tags: cli, password-management, password-manager, security. - [rbw](https://www.automicvault.com/pkg/brew/rbw/) - Shares av.db curated category or tags: cli, password-management, password-manager, security. - [gopass-jsonapi](https://www.automicvault.com/pkg/brew/gopass-jsonapi/) - Shares av.db curated category or tags: cli, password-management, password-manager, security. - [gopeed](https://www.automicvault.com/pkg/brew/gopeed/) - Shares av.db curated category or tags: cli, password-management, password-manager, security. ## Combined YAML source View the package source record on GitHub. [combined/gokey.yml](https://github.com/automic-vault/db/blob/main/combined/gokey.yml) ## Sources - Nucleus package database - Geiger risk classifier - package-page enrichment - curated package history - package version freshness - av.db category and tag curation - package relationship graph - external package-manager database matches - cross-ecosystem install command graph