Requirements

The extension needs a local GPG installation because rpass encrypts and decrypts entries on your machine:

• macOS / Linux: GnuPG
• Windows: Gpg4win
• Optional: Git if you want to sync your vault with rpass git ...

Setup

This is a Raycast extension that uses the rpass CLI under the hood.

Install rpass

Install the CLI from crates.io:

cargo install rpass-cli

Or download a binary from the rpass-cli releases.

Raycast may not inherit the same PATH as your shell. The extension automatically checks common locations such as ~/.cargo/bin/rpass, /opt/homebrew/bin/rpass, and /usr/local/bin/rpass. If it still cannot find rpass, set its absolute path in the extension preference rpass Executable Path. For Cargo installs on macOS, this is usually:

/Users/<you>/.cargo/bin/rpass

Windows

Auto-detection is tuned for macOS/Linux locations, so on Windows you should set the executable preferences explicitly if rpass and gpg are not already on your PATH:

• rpass Executable Path — e.g. C:\Users\<you>\.cargo\bin\rpass.exe
• GPG Executable Path — e.g. C:\Program Files (x86)\GnuPG\bin\gpg.exe (installed by Gpg4win)

Select your password store

rpass uses the standard password-store format: entries are encrypted files such as example/login.gpg, recipients are stored in .gpg-id, and decrypted entries keep the password on the first line.

By default, the extension uses:

~/.password-store

You can choose a different folder in the extension preference Password Store Directory.

If the selected store does not exist or has no .gpg-id, the extension will show a setup form. Enter one or more GPG recipients, such as an email, key ID, or fingerprint, and the extension will initialize the store for you.

Optional Git Sync

If your password store is a Git repository, write commands are committed automatically by rpass. Use the Sync Vault command to initialize Git for a new store, view recent history, pull changes, or push local commits.

Usage

The extension provides commands for common password-store workflows:

• Vault: browse, search, decrypt, copy, paste, edit, move, or delete entries.
• New Entry: generate a password or passphrase and save it to the store.
• Sync Vault: inspect Git status/history and run pull or push.

When opening an encrypted entry, the extension may ask for your GPG passphrase. It uses rpass --passphrase-stdin so the passphrase is passed through stdin, not through command-line arguments.

Avoiding GPG Timeouts

If decrypting entries times out, GPG may be waiting for pinentry. For non-interactive unlocks, enable loopback pinentry.

macOS / Linux

Edit ~/.gnupg/gpg-agent.conf and add:

allow-loopback-pinentry

Restart gpg-agent:

gpgconf --kill gpg-agent

Windows

Edit %APPDATA%\gnupg\gpg-agent.conf and add:

allow-loopback-pinentry

Restart gpg-agent:

gpgconf --kill gpg-agent

This does not change GPG cache durations. It only allows rpass --passphrase-stdin to pass the passphrase directly to GPG instead of opening a pinentry UI.

Security

The extension relies on the rpass CLI and GnuPG, so the same security model applies:

• passwords remain in your local password-store-compatible repository;
• entries are decrypted only when you explicitly open or use them;
• vault listing uses rpass list --json and does not decrypt entries in bulk;
• GPG passphrases are never passed as command-line arguments;
• generated or decrypted secrets are not stored by the extension;
• the extension only stores a short-lived non-secret marker that GPG was recently unlocked, so it can try the already-unlocked gpg-agent before prompting again.

Local Development

Install dependencies:

npm install

Run the extension in Raycast development mode:

npm run dev

Run checks before declaring work done:

npx tsc --noEmit
npm test
npm run lint -- --exit-on-error --non-interactive