OkcAgent VS pass-tomb

It's a bit complicated, but you can use GPG for this! You can follow this guide to setup GPG, and follow this issue to set it up with Termux, then use OKCAgent's GPG function to en/decrypt any files. You can then use any CLI TOTP program and de/encrypt the key files with your GPG key. It's not as secure as having them on the key, as the private keys for the TOTP have to be in your phone's RAM. You can write a shell script for that and put a widget to it on your home screen.

[1]: https://github.com/DDoSolitary/OkcAgent

Simple password decrypt: okc-gpg -d ~/.password-store/mypass.gpg

I made a termux shortcut (button on homescreen) to emulate pass-dmenu via this ( store in ~/.shortcuts):

  #!/data/data/com.termux/files/usr/bin/env bash

By itself, Passwordstore will not encrypt file names or directory names, which might not be a problem if no one else has access to the machine that hosts your git repo, but if that's not the case (even if it's a private repo on whatever platform), you might want to use either Tomb or git-crypt-remote to have full end-to-end encryption. There are even some tools that glue tomb and pass together (https://github.com/roddhjav/pass-tomb for one), though I'm not sure what's the situation is like when it comes to mobile integration with tomb/git-crypt-remote.

That can of course be fixed by using pass-tomb, but that isn’t implemented in mobile clients (at least not on iOS).

- https://pujol.io/blog/tomb-with-gpg-keys/ - https://github.com/roddhjav/pass-tomb

A plug-in called pass-tomb exists to fix this, but doesn’t work with mobile apps (a least not iOS)