Many websites now require two-factor authentication (2FA) with one-time passwords (OTP) to strengthen account security. Users typically store these OTP secrets in mobile authenticator apps. Accessing tokens on a desktop is often more convenient — especially when you are already working on a computer. Because no native Linux build of GNOME Authenticator exists, installing it through Flatpak or Snap feels excessive — particularly for users who prefer minimalist setups built around pass, the standard Unix password manager. If you already use pass, add the pass-otp extension to generate OTPs directly from the command line. Android users of Aegis Authenticator can migrate their tokens with the aegis2pass.py script, which converts the Aegis export into pass-compatible entries. With the accompanying select-pass.sh script, you can browse pass entries through a menu, then paste or copy both passwords and OTPs.

Select-pass.sh with OTP support and Aegis import

This guide shows you how to configure select-pass.sh so you can browse pass entries through a menu tool such as rofi or dmenu and then either type the secret into the active window or copy it to the clipboard. It also explains how to enable OTP generation with pass-otp and how to import Aegis tokens with aegis2pass.py. The full setup needs pass, a menu frontend, a typing or clipboard backend, and — optionally — pass-otp and aegis2pass.py.

For basic password copy/typing you need only: • pass • A menu frontend (rofi or dmenu) • A clipboard or typing backend — xclip/xdotool on X11, or wl-clipboard/ydotool on Wayland (most desktop environments already include the X11 tools).

pass-otp and aegis2pass.py (see its repository or gist) are optional yet recommended; both are simple scripts that work once they are somewhere in your $PATH.

1) Install prerequisites

Install core requirements.

• bash (shell to run the script)
• pass (password-store) and a working GPG setup

Install one menu frontend.

• X11: rofi or dmenu
• Wayland: wofi or Wayland-capable rofi (often packaged as rofi-wayland but invoked as rofi)

Install one typing backend.

• X11: xdotool
• Wayland: ydotool

Install clipboard helpers used by pass -c.

• X11: xclip or xsel
• Wayland: wl-clipboard

Install optional OTP support by adding the pass-otp extension.

Install (optional) prerequisites for Aegis import via aegis2pass.py.

• uv (used by the script’s shebang)
• Python ≥ 3.10 (managed by uv if configured)

Optional notifications:

• notify-send (from libnotify)

2) Install select-pass.sh

Place the script at a stable path, e.g. ~/bin/select-pass.sh, and make it executable.

chmod +x ~/bin/select-pass.sh

3) Quick manual test

~/bin/select-pass.sh

Select an entry.

• For rofi: Enter types into the focused window, and <Ctrl+Y> copies to clipboard.
• For dmenu or wofi: typing is the default unless --clip is used.

Force clipboard mode explicitly:

~/bin/select-pass.sh --clip

4) Bind to Meta+P

X11 – using xbindkeys or equivalent

"~/bin/select-pass.sh"
Mod4 + p

Wayland – compositor-specific bindings

• Sway: bindsym $mod+p exec ~/bin/select-pass.sh
• Hyprland: bind = SUPER, P, exec, ~/bin/select-pass.sh
• GNOME: Settings → Keyboard → Custom Shortcuts → command ~/bin/select-pass.sh

5) OTP support via pass-otp

Once pass-otp is installed, selecting an OTP entry automatically calls pass otp.

6) Import Aegis tokens with aegis2pass.py

Clone or download aegis2pass.py (see its repository) and make it executable.

chmod +x ~/bin/aegis2pass.py

Dry-run:

~/bin/aegis2pass.py /path/to/aegis-export.json --dry-run

Import:

~/bin/aegis2pass.py /path/to/aegis-export.json --prefix otp --use-groups

Verify:

pass otp otp/<imported-entry-name>

Use select-pass.sh to type or copy the same OTP.