Storing Credentials

Add credentials interactively with kosh add, or have Kosh generate strong passwords for you.

Kosh gives you two ways to put a secret into your vault:

kosh add — you type the secret, Kosh encrypts it.
kosh generate — Kosh creates a cryptographically random secret and encrypts it.

Both write into the active profile’s vault.

How a credential is identified

Every credential is identified by its label and user together:

Label	User
`github`	`alice`	personal account
`github`	`alice-work`	work account

These are two separate credentials. The same label can hold as many accounts as you need — the pair is what has to be unique.

Add a credential interactively

kosh add

All values are collected through prompts, so nothing sensitive ends up in your shell history:

(default) [?] enter master password:
(default) [?] enter credential label: github
(default) [?] enter credential user: alice
(default) [?] enter credential secret:
(default) [?] confirm credential secret:
(default) [✓] credential saved successfully

The secret is entered twice and the two entries are compared in constant time. A mismatch aborts with secrets do not match.

Overwriting an existing entry

If the label and user pair already exists, Kosh will not silently replace it. You get a caution block and have to type out an exact confirmation phrase:

  | /!\ CAUTION: CREDENTIAL OVERWRITE
  | This label and user already hold a credential and it will be OVERWRITTEN.
  | The operation is IRREVERSIBLE and the current secret is IRRECOVERABLE.

(default) [!] overwrite the existing credential? this cannot be undone
(default) [?] enter 'overwrite github alice' to confirm or anything else to cancel:

Typing anything other than the exact phrase cancels the operation and reports operation aborted.

If you only want to change the secret of an entry that already exists, kosh update is the gentler option — it walks you through changing a single field.

Generate a password

kosh generate <label> <user>

Kosh generates a cryptographically random password, copies it to your clipboard, and encrypts it into the vault after verifying your master password. The password is never printed — retrieve it later with kosh get or kosh search.

kosh generate github alice

Flags

Flag	Description	Default
`-l, --length int`	Length of the generated password	`20`
`--upper`	Include uppercase letters (A–Z)	`true`
`--lower`	Include lowercase letters (a–z)	`true`
`--digit`	Include digits (0–9)	`true`
`--symbol`	Include special symbols	`true`
`-r, --require string`	Minimum count per character group, e.g. `upper=2,digit=3`
`-n, --no-save`	Generate and copy to clipboard without saving	`false`

Boolean flags are on by default, so you disable them with the explicit =false form:

kosh generate --symbol=false server root

Requiring character groups

--require takes a comma-separated list of group=count pairs. Valid groups are lower, upper, digit and symbol:

kosh generate -l 32 --require "upper=2,lower=10,digit=5,symbol=3" email alice

Two rules apply:

Requirements cannot contradict a disabled group. Combining --symbol=false with symbol=2 is rejected.
If the required counts add up to more than --length, Kosh asks whether to grow the password to fit them:
```
(default) [?] required characters exceed length. increase length? [Y/n]:
```

Generating without saving

kosh generate --no-save

With --no-save, the label and user arguments can be omitted, no master password is requested, and nothing is written to the vault. The password is only copied to your clipboard — useful for a throwaway value you are about to paste into a signup form.

Storing into a different profile

add and generate always write to the active profile. To store somewhere else, switch first:

kosh use work
kosh add

Or add it here and copy it across afterwards:

kosh add
kosh list          # find the ID
kosh copy 7 work

See the Profiles guide for how copying between vaults works.