Install Kosh

How to install Kosh, the local-first encrypted password manager, on Linux, macOS and Windows.

Kosh is a single, statically linked binary with no runtime dependencies — no CGO, no system libraries, no daemon. There are three ways to get it:

Download a prebuilt binary (easiest)
go install (recommended for Go users)
Build from source

Download a prebuilt binary

Prebuilt binaries are published for macOS, Linux, and Windows.

Visit the releases page: Kosh Releases

Download the archive for your platform:

Platform	Archive
macOS (Apple Silicon)	`kosh_Darwin_arm64.tar.gz`
macOS (Intel)	`kosh_Darwin_x86_64.tar.gz`
Linux (AMD64)	`kosh_Linux_x86_64.tar.gz`
Linux (ARM64)	`kosh_Linux_arm64.tar.gz`
Linux (32-bit x86)	`kosh_Linux_i386.tar.gz`
Windows (AMD64)	`kosh_Windows_x86_64.zip`
Windows (32-bit x86)	`kosh_Windows_i386.zip`

Extract the executable and move it onto your PATH.
Terminal window
```
tar -xzf kosh_*.tar.gz
chmod +x kosh
sudo mv kosh /usr/local/bin/kosh
```
On Windows, extract the .zip and move kosh.exe into a directory listed in your Path environment variable.

Using `go install`

go install git.plutolab.org/plutolab/kosh@latest

This installs the kosh binary into your Go bin directory (usually ~/go/bin). Make sure that directory is on your PATH:

export PATH="$PATH:$(go env GOPATH)/bin"

Build from source

git clone https://git.plutolab.org/plutolab/kosh.git
cd kosh
go build

This produces a kosh binary in the project root for your current platform.

Platform notes

Kosh copies retrieved secrets to your system clipboard, and clipboard access is the one thing that depends on your environment:

macOS and Windows work out of the box.
Linux requires a running display server (X11 or Wayland). On a bare TTY or over SSH with no display, the clipboard is unavailable and copying will fail.

Everything else — the vault, encryption, search — is pure Go and works identically everywhere.

Verify the installation

kosh --version

Then check the command list:

kosh --help

Kosh is a secure, offline vault for storing, generating and retrieving credentials.

Credentials are encrypted with Curve25519, XChaCha20-Poly1305 and Argon2id, and
kept in a local SQLite vault under ~/.kosh - nothing ever leaves your machine.

Retrieved secrets are copied to the clipboard, never printed to the terminal.

Any argument that is not a known subcommand is treated as a search query, so
"kosh github" is shorthand for "kosh search github".

Run "kosh init" once to create the vault before using any other command.

Usage:
  kosh [command]

Available Commands:
  add         Interactively add a new credential to the vault
  completion  Generate the autocompletion script for the specified shell
  copy        Copy a credential into another profile
  delete      Permanently delete a credential by ID
  generate    Generate a strong random password and store it
  get         Copy a credential matched by exact label and user
  help        Help about any command
  init        Initialize the vault for the active profile
  list        Show a table of saved credentials
  profile     Manage profiles and their vaults
  search      Copy a credential found by fuzzy search (default command)
  update      Update the label, user or secret of a credential
  use         Switch the active profile

Flags:
  -h, --help      help for kosh
  -v, --version   version for kosh

Use "kosh [command] --help" for more information about a command.

Shell completion

Kosh can generate completion scripts for bash, zsh, fish and powershell:

kosh completion zsh > "${fpath[1]}/_kosh"

Run kosh completion <shell> --help for the exact installation steps for your shell.

Kosh is installed. Head to the Quick Start to create your vault.

Install Kosh

Download a prebuilt binary

Using go install

Build from source

Platform notes

Verify the installation

Shell completion

Using `go install`