Security
▶SECURITY, BY DESIGN
ClaudePass is free and open source under the MIT license — read the code yourself on GitHub. This page still says exactly what each component does and touches, for anyone who'd rather read a summary first.
cpass binary ever makes, in any command, at any
point, is none. The one thing outside the binary that does
touch the network is install.sh, which fetches a
release archive over HTTPS to install cpass in the
first place — nothing else, ever.
The Vault
Your Secrets live in one encrypted file on your own machine
($CPASS_HOME/vault.cpv), never synced or uploaded,
addressed only by a Handle like stripe/live.
It's a JSON envelope encrypted with XChaCha20-Poly1305 (an AEAD
cipher) under a random data key, itself wrapped by your unlock
key. Tampering and a wrong key fail loudly and distinctly — the
Vault never opens partially or silently drops entries.
Where the unlock key lives
On macOS, the key lives in a Keychain item read by the
security command-line tool — no daemon. On Linux
(and CI), a local Broker process holds the key in memory behind a
user-only Unix domain socket after cpass unlock, and
drops it after an idle timeout or cpass lock. Either
way, the key never touches the network and is never written to
disk in plaintext.
Redaction: best-effort by design
Everything a wrapped command writes to stdout and stderr passes through Redaction, which replaces an injected Secret's value — and its base64, hex, percent-, and JSON-escaped forms — with a [REDACTED:<handle>] marker before your Agent can read it. This is honest best-effort, not a guarantee: it covers the encodings above and a value written in pieces across separate writes, but a value the child transforms some other way before printing it (a bespoke encoding, compression, encryption) passes through unrecognized. ClaudePass makes leaking a Secret hard and detectable, not impossible.
Command Policy
Before a command runs, Command Policy refuses the well-known ways
a command tries to defeat Redaction on purpose: dumping the
environment, reading a Secret-bearing file like .env
or an SSH private key, or handing cpass add an inline
value that would bypass its terminal-only gate. It's a static
check — it fails closed on a shell shape it can't parse rather
than run it unchecked, but it isn't a sandbox, so a command that
computes what it does at run time (an interpreter's own script, a
program that opens a file itself) can still fall outside what it
catches. The same rule set runs in the CLI, the Claude Code hook,
and the MCP server, other than a couple of narrow, disclosed
exceptions — see
the threat model
on GitHub for exactly what those are and aren't.
What a refusal looks like — the exact message cpass prints, verbatim.
Intercept
When a human pastes a real value into a conversation by mistake,
Claude Code's UserPromptSubmit hook runs
cpass intercept: it moves the value into the Vault
before the model ever sees the prompt and tells the human which
Handle to resubmit with instead.
Exposed tracking
When a value does reach an Agent's Context anyway — a deliberate bypass, a manual paste before the plugin was installed — ClaudePass records that fact rather than pretending it didn't happen, so rotation is a nagged, tracked action instead of a silent gap.
What this doesn't attempt
ClaudePass has no notion of authorization — anyone who can run
cpass as your Vault's owning user can use every
Handle in it. There's no sync across machines, no team sharing,
and no automatic rotation. If your account is already
compromised — another process running as the same user, arbitrary
code execution — ClaudePass keeps a Secret out of an Agent's
Context; it is not a defense against that compromise itself.