Help / Getting started
Getting started
Updated July 15, 2026
BipPass encrypts your secrets on your own machine before they are sent anywhere. The CLI is the fastest way in — it does the encryption locally and never sends your password.
Install
The CLI is written in Go and installs from source today. There is no Homebrew formula yet.
# build into dist/bippass $ make build
# or install onto your PATH $ make install
Create an account
There is no default server, so the first command you run has to say where your BipPass lives. Registering generates your encryption keypair on your machine.
$ bippass register --server https://your-bippass-server Name: Ada Email: ada@example.com Password: Confirm password: ✓ Account created. Run 'bippass login' to sign in.
Then sign in. Logging in also unlocks your encryption key: your password is used on the spot to derive a key and unseal your private key, and is never stored or sent.
$ bippass login --server https://your-bippass-server Email: ada@example.com Password: ✓ Logged in as ada@example.com · workspace: acme
If this is a machine you have not used before, the login may stop with "Device pending approval". That is expected — see Devices & trust.
Set up somewhere to put secrets
A secret lives in one environment of one project, inside a workspace. A new project has no environments, so create one before you try to store anything.
$ bippass workspaces create acme $ bippass projects create api $ bippass environments create production
Point the CLI at that workspace, project and environment once, and every later command uses it.
$ bippass use acme/api/production $ bippass context workspace: acme · project: api · environment: production
Store your first secret
$ bippass set DATABASE_URL=postgres://localhost/acme ✓ Created DATABASE_URL
$ bippass ls KEY VALUE VERSION DATABASE_URL •••••• v1
That value was encrypted before it left your machine. The server stores ciphertext it has no key for.