# Install gokey with Homebrew, apt, MacPorts, Nix Simple vaultless password manager in Go. Version 0.2.1 via Homebrew; verified 2026-07-25. Also installable with debian: sudo apt install gokey. ## Install ```sh sudo av install brew:gokey ``` Additional install commands: ### macOS - Homebrew (100%): ```sh brew install gokey ``` Evidence: local Homebrew formula metadata - MacPorts (94%): ```sh sudo port install gokey ``` Evidence: MacPorts ports tree: security/gokey/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1 ### Linux - Debian apt (92%): ```sh sudo apt install gokey ``` Evidence: Debian stable package indexes: gokey from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz - Nix (92%): ```sh nix profile install nixpkgs#gokey ``` Evidence: nixpkgs package indexes: pkgs/by-name/go/gokey/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 ## Package facts - **Package key:** brew:gokey - **Package manager:** Homebrew - **Version:** 0.2.1 - **Source summary:** Simple vaultless password manager in Go - **Homepage:** - **Repository:** - **Last updated:** 2026-07-25T20:55:24-04:00 - **Generated:** 2026-08-03T19:37:03+00:00 ## Executables - gokey (alias) ## Install behavior - Bottle: not available ## Freshness - Page generated: 2026-08-03 - Package-manager version: 0.2.1 ## Project history and usage gokey is Cloudflare's vaultless password manager written in Go. Instead of storing passwords in a vault, it derives passwords and keys from a master password plus a realm string, with optional encrypted seed-file mode for higher-entropy material. The project sits in the deterministic-password-manager family: the user keeps a master secret and recreates site-specific outputs rather than synchronizing a password database. ### Project history The repository begins in October 2016 with an initial release. The README describes simple password derivation, seed-file mode, and support for output types including passwords, raw bytes, ECC keys, RSA keys, x25519, and ed25519. Early history focused on random-generation internals and command behavior. Later history includes release-binary automation, dependency updates, imported deterministic key-generation logic from Go's crypto packages, and seed unwrap testing. ### Adoption history gokey's adoption is mostly that of a compact security utility: it is useful to users who do not want to store, back up, or synchronize a password vault. The README emphasizes that generated passwords are available wherever the user can provide the same master password and realm. The input package facts list Homebrew, Debian, MacPorts, Nix, and Ubuntu package names, which indicates distribution through both macOS-focused and Linux distribution channels. ### How it is used In simple mode, a user runs gokey with a master password and a realm such as a resource URL. Changing the realm derives a different output while keeping the same master password. For higher-entropy passwords or private keys, the README documents seed-file mode: generate an encrypted seed file, protect it with the master password, and derive passwords or keys from the seed plus realm. Seed paths are command inputs rather than a fixed credentials-file location. ### Why package nerds care gokey matters to package nerds because it is a small, auditable-feeling security CLI with no vault service, database daemon, or sync dependency. Its packaging footprint is a single Go command, but its security model lives in deterministic derivation choices. It is also a useful contrast with mainstream password managers: packaging the tool is easy, while the hard part is documenting the operational warning that losing the master password or seed file loses the derived outputs. ### Timeline - 2016: Repository begins with an initial release. - 2016: Early commits change random-generation internals and output conditioning. - 2022: Release-binary publishing through GitHub Actions is added. - 2023: Deterministic key-generation logic from Go crypto packages is imported. - 2026: v0.2.1 tag appears with public KeyGen RNG member work. ### Related projects - Go's crypto packages are related through key-generation behavior referenced in repository history. - Deterministic password managers are the broader tool family; gokey's distinguishing feature is combining password and private-key derivation in a Go CLI. - Cloudflare is the upstream organization that publishes the repository. ### Sources - - - ## Security Notes narrow executable package without higher-risk signals. - **Geiger risk:** green / low - narrow executable package without higher-risk signals ## Other Package-Manager Records - Debian apt - gokey - 0.1.2-1+b13: normalized package name match | Debian stable package indexes: gokey from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | simple vaultless password manager in Go | https://github.com/cloudflare/gokey - Debian apt - golang-github-cloudflare-gokey-dev - 0.1.2-1: normalized package name match | Debian stable package indexes: golang-github-cloudflare-gokey-dev from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | simple vaultless password manager in Go - dev package | https://github.com/cloudflare/gokey - Nix - gokey: normalized package name match | nixpkgs package indexes: pkgs/by-name/go/gokey/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - Ubuntu apt - gokey - 0.1.2-1build1: normalized package name match | Ubuntu 24.04 LTS package indexes: gokey from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | simple vaultless password manager in Go | https://github.com/cloudflare/gokey - Ubuntu apt - golang-github-cloudflare-gokey-dev - 0.1.2-1build1: normalized package name match | Ubuntu 24.04 LTS package indexes: golang-github-cloudflare-gokey-dev from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | simple vaultless password manager in Go - dev package | https://github.com/cloudflare/gokey - MacPorts - gokey: normalized package name match | MacPorts ports tree: security/gokey/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1 ## Combined YAML source View the package source record on GitHub. [combined/gokey.yml](https://github.com/mxcl/pkgdb/blob/main/combined/gokey.yml) ## Sources - pkg.so package database - Geiger risk classifier - curated package history - pkgdb category and tag curation - external package-manager database matches - cross-ecosystem install command graph