A password manager
for coding agents.
Your agent finds, uses and saves secrets without ever seeing them. You approve once per task and project, not once per shell.
A real session, replayed. When the approval window opens, you answer it.
Use credentials as freely as a trusted teammate would.
Without the secret entering the model’s context, and without you babysitting every shell. The agent works with references; visipassd decides what may resolve them and hands the values straight to the command.
Sees references, receipts and masked output.
- Who is asking: the agent from the process tree
- Where: the session’s project and git remote
- What: operation and exact references
Gets the value in its environment. Its output is masked on the way back.
Find, write and run with op:// references. Printing a value to the agent is a separate operation you grant by name, and it is logged.
The prompt names the agent, project, git remote, command, every secret and the agent’s stated purpose. Inside a grant there are no prompts at all.
A grant covers the exact agent, project, operation and references you saw. A new key, or reading instead of running, asks again.
Written to a SHA-256 chained log before the result goes back. If the log can’t be written, the request fails.
Five answers. Deny is the default.
The window opens on Deny, ignores input for its first 700ms so a stray keypress can’t approve, and Escape, closing it or a crash all deny. No
agent can approve its own request: there is no vp approve, and nothing an agent sets decides where the prompt appears.
On Omarchy it takes your theme’s colours, fonts and Hyprland’s rounding every time it opens.
- d DenyRefused. The agent is told not to retry and to ask you instead.
- o OnceThis one request.
- t This taskUntil this agent session ends.
- h 8 hoursThis agent, in this project, for 8 hours.
- a AlwaysThis agent, in this project, until you revoke it.
When a command prints the secret, nobody reads it.
vp run masks every injected value in the command’s output as <vp:NAME>, including its
base64, URL-safe base64, percent-encoded and JSON-escaped forms, even when a value is split across chunks. This is the same masker, running on
what you type. Nothing leaves your browser.
VisiPass is not a sandbox: a command given a secret can do anything with it. Masking keeps it out of the transcript, not out of the command.
And for you, a password manager.
The Chrome extension fills logins, passkeys and two-factor codes on the site they belong to, suggests strong passwords on sign-up and offers to save what you submit.
- → Fills only the approved site, matched by the Public Suffix List, and only visible fields.
- → Acts only on your real clicks, with its menu actually visible on screen.
- → Imports from 1Password and Proton Pass, passkeys included.
- → A desktop app and
vp quickQuick Access, themed like the rest of your desktop.
Try it: click the keyhole in the email field, or switch to Sign up. The password is generated in your browser the way VisiPass generates one.
Keep 1Password, or bring your own vault.
vp reaches your existing vaults through the 1Password CLI and adds grants, the approval prompt, masking and the access
log. 1Password still stores and encrypts everything. This is the part to rely on today.
$ yay -S visipass-bin 1password-cli $ vp doctor
End-to-end encrypted with a master password and Secret Key. vp import op brings your 1Password vaults over and every
op:// reference keeps working. Syncs through a folder you already sync, as encrypted, signed files; there is no VisiPass server.
- · Locks when you’re idle
- · Locks with the screen
- · Erases keys before sleep
- · Fingerprint quick unlock
Internally reviewed, not yet audited from outside. Keep 1Password as your backup for now.
One obvious command per goal.
Compact JSON on stdout, and errors that say what to do next. Give your agent the skill file and it knows the rules: batch, state a purpose, never retry a denial. There’s an MCP server too.
- $ vp find openai stripe
- # references, never values; one call for many queries
- $ vp run --env "KEY=op://…" -- bun dev
- # inject, run, mask the output
- $ vp env run .env.tpl -- cargo test
- # one approval for every reference in the file
- $ vp env import .env --vault Dev
- # move plaintext secrets into the vault, rewrite to refs
- $ vp request --title "Stripe Live Key"
- # you paste it in a VisiPass window; the agent gets a ref
- $ vp create api-credential --clipboard
- # save a new key; read back and verified, never overwritten
- $ vp kamal-fetch --from "op://…" A B C
- # a whole Kamal deploy in one approval
- $ vp log · vp grant list
- # what was asked for, by whom, and what you allowed
Running in a minute.
Linux on x86_64 and aarch64, Omarchy first. Needs the 1Password CLI with app integration turned on.
yay -S visipass-bin 1password-cli
Download from the latest release and put
vp, visipassd and visipass-prompt on your PATH.
cp SKILL.md ~/.claude/skills/visipass/
Then vp doctor.