PW(1) General Commands Manual PW(1)

pw — A deterministic password generator.

pw [switches] [--] [arguments]

pw is a deterministic password generator that lets you create passwords based on your master password with the following method.

base64(sha3_512("master_password,then,comma,separated,values"))

If you don’t have a master password yet:

pw --init

The openssl(1) equivalent is:

openssl rand -base64 16 | tr -d '\n' | openssl dgst -binary -sha3-512 | openssl enc -A -base64

Generates 16 random bytes that are encoded into base64(1), then passed to the password generator.

Set your user—‘taupiqueur@kanto’—password:

pw --length=10 kanto taupiqueur

Sign up Google:

pw --length=10 google.com taupiqueur.kanto

The openssl(1) equivalent is:

printf 'Strong password,google.com,taupiqueur.kanto' | openssl dgst -binary -sha3-512 | openssl enc -A -base64 | head -c 10

Pet name:

pw --length=10 google.com taupiqueur.kanto Bunny

The openssl(1) equivalent is:

printf 'Strong password,google.com,taupiqueur.kanto,Bunny' | openssl dgst -binary -sha3-512 | openssl enc -A -base64 | head -c 10

Sign up Apple:

pw --length=10 apple.com taupiqueur.kanto@gmail.com

The openssl(1) equivalent is:

printf 'Strong password,apple.com,taupiqueur.kanto@gmail.com' | openssl dgst -binary -sha3-512 | openssl enc -A -base64 | head -c 10

Show password before hashing:

pw --show google.com taupiqueur.kanto

The command’s output is:

Strong password,google.com,taupiqueur.kanto

The method format is , from generic to specific.

Copy password:

pw --copy google.com taupiqueur.kanto

Attempt to set the terminal clipboard content using the xterm(1) escape sequence.

If a special character is required, just add an apostrophe—for .

On the contrary, if special characters are not allowed, use the --alphanumeric-only option to drop the ‘+’, ‘/’ and ‘=’ characters from the base64(1) table.

The option exists to mitigate the need to tweak your password in a second pipe—and probably a third pipe for copying.

Finally, you might want to specify a version to your password:

pw --length=10 kanto taupiqueur 2

The openssl(1) equivalent is:

printf 'Strong password,kanto,taupiqueur,2' | openssl dgst -binary -sha3-512 | openssl enc -A -base64 | head -c 10

Depending on my situation here are the tools I use:

The options are as follows:

, --init
Generate a secure, random password.
length, --length=length
Specifies the password length.
, --alphanumeric-only
Remove non-alphanumeric characters.
, --show
Show password.
, --copy
Copy password.

Attempt to set the terminal clipboard content using the xterm(1) escape sequence.

-
Read master password from stdin.
, --rescue
Rescue mode.

Print all password methods to date.

, --help
Show this help.
, --version
Show version.

The following environment variables have an effect on pw.

Specifies the master password.

Report bugs on the
issue tracker,
ask questions on the
IRC channel,
send patches on the
mailing list.

Mathieu Ablasou <taupiqueur.kanto@gmail.com>

November 26, 2021