OkcAgent VS pass-code

It's a bit complicated, but you can use GPG for this! You can follow this guide to setup GPG, and follow this issue to set it up with Termux, then use OKCAgent's GPG function to en/decrypt any files. You can then use any CLI TOTP program and de/encrypt the key files with your GPG key. It's not as secure as having them on the key, as the private keys for the TOTP have to be in your phone's RAM. You can write a shell script for that and put a widget to it on your home screen.

[1]: https://github.com/DDoSolitary/OkcAgent

Simple password decrypt: okc-gpg -d ~/.password-store/mypass.gpg

I made a termux shortcut (button on homescreen) to emulate pass-dmenu via this ( store in ~/.shortcuts):

  #!/data/data/com.termux/files/usr/bin/env bash

There's the pass-code extension for that:

https://github.com/alpernebbi/pass-code

> A pass extension that obscures the filenames and folder hierarchy within your password store.

> pass-code generates random filenames for each file in the password store and keeps the mapping in an encrypted file. This way, no valuable information is accessible even if your password store is leaked to the public (unless your GPG private keys were also leaked). Nevertheless, you should always ensure proper protection of your password store.