Skip to content
NewPassbox is here: on the web, desktop, iPhone, Android and your own server.Passbox is here · See all apps
Passbox
Get Passbox
GitHubGet Passbox

Passbox for developers

Secrets in your commands, not in your files.

pbx resolves pbx:// references and passes secrets only to the process that needs them. No .env files with plain text, no secrets in shell history, offline when the server is not reachable.
Read the CLI docsAI agents
  • Written in Rust
  • Open API (OpenAPI)
  • MIT License

Command line

pbx run, and your secrets stay out of the repo

Set environment variables to secret references and run your command through pbx. The child process gets the secrets; your files and your shell never see them.

terminal
$ export DATABASE_URL=pbx://Work/Database/url$ export STRIPE_KEY=pbx://Work/Stripe/secret-key$ pbx run -- npm run deploy

  • Secret references

    pbx://Work/Database/password points to one field of one item.

  • pbx run

    Resolves every reference and passes the values only to the child process.

  • Offline copy

    Reads from an encrypted local copy when the server is not reachable.

  • Create and edit items

    pbx item create, edit and pbx inject for config templates.

Automation

Built to be scripted

Everything the apps do goes through a documented API. Machines get their own identities, scoped to the vaults they need.

  • Open API

    The server is a plain, documented API (OpenAPI 3).

  • Service accounts

    Machine identities with read-only access to chosen vaults, an expiry and a log of every use.

  • AI agents via MCP

    pbx mcp lets coding agents use secrets after your approval, without seeing them.

Under the hood

One Rust core, everywhere

All cryptography lives in one Rust crate. The web app and extension use it as WebAssembly, the phone apps through UniFFI, the CLI natively.

  • Readable cryptography

    Argon2id, OPAQUE, XChaCha20-Poly1305, X-Wing and Ed25519, documented in the repository.

  • PostgreSQL

    Separate database roles, row-level security for the app, migrations in their own step.

FAQ

Questions, answered

Can pbx write secrets?

Yes. pbx creates and edits items, and pbx inject fills config templates. It also signs in, lists, reads, resolves references, generates passwords and shows 2FA codes.

How do I use pbx in CI?

With a service account: a machine identity with a scoped, expiring token that can read only the vaults you allow. Service accounts are free and never count as members.

Get secrets out of your dotfiles.

Install pbx with Cargo and point it at your server.

CLI documentationAPI reference