Security
ClaudePass is closed source, so trust has to come from documentation rather than from reading the code yourself. This page says exactly what each component does and touches.
cpass binary ever makes, in any command, at any
point, is none. Two things outside the binary do touch the
network, and neither is telemetry:
install.sh fetches a release archive over HTTPS to
install cpass in the first place, and the license
service is the separate hosted component that issues license
tokens after Stripe Checkout — the cpass binary you
run afterwards never talks to it.
The Vault
Your Secrets live in one encrypted file on your own machine
($CPASS_HOME/vault.cpv), never synced or uploaded.
It's a JSON envelope encrypted with XChaCha20-Poly1305 (an AEAD
cipher) under a random data key, itself wrapped by your unlock
key. Tampering and a wrong key fail loudly and distinctly — the
Vault never opens partially or silently drops entries.
Where the unlock key lives
On macOS, the key lives in a Keychain item read by the
security command-line tool — no daemon. On Linux
(and CI), a local Broker process holds the key in memory behind a
user-only Unix domain socket after cpass unlock, and
drops it after an idle timeout or cpass lock. Either
way, the key never touches the network and is never written to
disk in plaintext.
Redaction: best-effort by design
Everything a wrapped command writes to stdout and stderr passes
through Redaction, which replaces an injected Secret's value —
and its base64, hex, percent-, and JSON-escaped forms — with a
[REDACTED:<handle>] marker before your Agent
can read it. This is honest best-effort, not a guarantee: it
covers the encodings above and a value written in pieces across
separate writes, but a value the child transforms some other way
before printing it (a bespoke encoding, compression, encryption)
passes through unrecognized. ClaudePass makes leaking a
Secret hard and detectable, not impossible.
Command Policy
Before a command runs, Command Policy refuses the well-known ways
a command tries to defeat Redaction on purpose: dumping the
environment, reading a Secret-bearing file like .env
or an SSH private key, or handing cpass add an inline
value that would bypass its terminal-only gate. The same rule set
runs in the CLI, the Claude Code hook, and the MCP server.
Intercept
When a human pastes a real value into a conversation by mistake,
Claude Code's UserPromptSubmit hook runs
cpass intercept: it moves the value into the Vault
before the model ever sees the prompt and tells the human which
Handle to resubmit with instead.
Exposed tracking
When a value does reach an Agent's Context anyway — a deliberate bypass, a manual paste before the plugin was installed — ClaudePass records that fact rather than pretending it didn't happen, so rotation is a nagged, tracked action instead of a silent gap.
The license check is offline
A license token is signed with Ed25519; the public key that
verifies it ships inside the cpass binary.
cpass license activate verifies the signature
entirely locally and, only if it verifies, stores the token — it
never sends the token, or anything derived from it, anywhere.
What this doesn't attempt
ClaudePass has no notion of authorization — anyone who can run
cpass as your Vault's owning user can use every
Handle in it. There's no sync across machines, no team sharing,
and no automatic rotation. If your account is already
compromised — another process running as the same user, arbitrary
code execution — ClaudePass keeps a Secret out of an Agent's
Context; it is not a defense against that compromise itself.