Hi everyone,

I use Enpass as my password manager and missed a quick way to reach it from Alfred, so I built a workflow for it. It searches your Enpass vault straight from Alfred and copies passwords, usernames, one-time codes (2FA) or any other field without opening Enpass.

GitHub: https://github.com/x-o-r-r-o/alfred-enpass
Download (latest release): https://github.com/x-o-r-r-o/alfred-enpass/releases/latest

Usage

Search your Enpass vault via the enp keyword. Type to filter by title, username, category or website.

• ↩ Copy password (or paste it, as set in the Workflow's Configuration).

• fn↩ Do the opposite: paste instead of copy, or copy instead of paste.

• ⌘↩ Copy username.

• ⌥↩ Copy one-time code.

• ⌃↩ Open website.

• ⇧↩ Show all fields of the entry.

• ⌘Y Quick Look website.

In the fields list, ↩ copies a field, ⌘↩ pastes it and ⌃↩ opens a website field. Card numbers, PINs, recovery codes and other hidden fields are masked. Type lock to forget the saved master password.

Alternatively, search Enpass for selected text or a website's domain via the Universal Action.

Configure the Hotkey to open the search directly.

Setup

1. Install enpass-cli, which reads the vault: brew install enpass-cli

2. Download Enpass.alfredworkflow from the release page above and open it.

3. If your vault is protected with a keyfile, choose it in the configuration window. The default vault folder is Enpass's primary vault; change it if you use another one (Enpass → Settings → Advanced → Data Location).

4. Type enp, press ↩ on "Unlock … vault" and enter your master password. It's checked against the vault and saved in your macOS Keychain.

Requirements: Alfred 5 with the Powerpack, Enpass 6 on the same Mac, enpass-cli.

Configuration

• Keyword (default enp)

• Vault Folder

• Keyfile (only for keyfile-protected vaults)

• Action on ↩: copy or paste into the frontmost app

• Clear Clipboard: after 10–90 seconds, or never (default 30 seconds)

• Include entries in the Enpass trash

• enpass-cli path (found automatically in /opt/homebrew/bin or /usr/local/bin)

How it works and security

Enpass doesn't offer an API or AppleScript support, and its browser extensions use a private connection to the app. So this workflow reads the vault file directly through the open-source enpass-cli (https://github.com/hazcod/enpass-cli) by hazcod, which handles the decryption.

• Read-only: the vault is never modified, and nothing is sent over the network.

• The master password is stored in your login Keychain and passed to enpass-cli only through its environment, never on a command line.

• Search results never contain secrets. Passwords and codes are only read when you pick an action, and go straight to the clipboard without passing through Alfred.

• Copied values are marked as concealed/transient, so Alfred's Clipboard History and other clipboard managers skip them, and they're kept off Universal Clipboard. The clipboard is cleared after the configured delay, unless you copied something else in the meantime.

• Only http and https websites are opened.

Please be aware that while your login keychain is unlocked, any program running as your user can read the saved master password through Apple's security tool. This is the same trust model as other password-manager workflows, so I don't recommend it on a Mac you share an account on.

Known limitations

• Entries with no fields at all (for example a secure note with only note text) aren't listed, because enpass-cli skips them.

• Archived entries are listed like any other.

• One vault per workflow; duplicate the workflow for a second vault.

Testing

I've tested it with Enpass 6.12.5 on macOS 26 against a vault of about 2,400 entries protected with a keyfile, including 2FA codes and paste mode. The repository also has 96 automated end-to-end checks that run against encrypted test vaults (Unicode and odd characters in passwords, duplicate titles, keyfiles, wrong passwords, clipboard clearing and more).

Disclosure

This workflow was built with the help of an AI assistant (Claude). I reviewed and tested it on my own vault, and the full source is on GitHub for anyone to audit. It isn't affiliated with or endorsed by Enpass.

Feedback, bug reports and ideas are very welcome, here or on GitHub: https://github.com/x-o-r-r-o/alfred-enpass/issues

Update: v1.1.0 — Touch ID unlock

Download: https://github.com/x-o-r-r-o/alfred-enpass/releases/latest

New: Touch ID

• Turn on Touch ID in the Workflow's Configuration, then choose when the vault locks again with Auto-Lock: after every copy, after 1 minute to 4 hours of inactivity, or only when the Mac restarts. The default is 15 minutes.

• While locked, enp shows Unlock with Touch ID instead of your entries, and a copy asks for Touch ID first.

• Works on every Mac: Macs without Touch ID (or with the lid closed) ask for your Mac password, and an Apple Watch can confirm too. On a Mac without a login password, the Enpass master password is asked instead.

• Type lock and choose Lock Vault to lock it right away.

• While Touch ID is on, search results are never cached, so a locked vault never shows entries.

The master password is still needed once, the first time. Touch ID is off by default, so nothing changes until you switch it on.

Also since the first release (v1.0.1)

• Fixed ⌘↩, ⌥↩, ⌃↩, ⇧↩ and fn↩ doing nothing in Alfred.

• Only the entries you act on are decrypted, never the whole vault. Usernames, websites and other non-secret fields are copied without decrypting anything.

• Notifications no longer name the entry or show website addresses.

• Logins inside website addresses (user:pass@…) are never displayed.

To update, download Enpass.alfredworkflow from the link above and open it. Your settings are kept.

Everything is covered by 138 automated tests, and the changelog is here: https://github.com/x-o-r-r-o/alfred-enpass/blob/main/CHANGELOG.md

Feedback and bug reports are welcome, here or at https://github.com/x-o-r-r-o/alfred-enpass/issues

I have no problems with Alfred and Enpass:

@Tobi This is not a problem but a workflow for enpass. Posted here because i did not found any other appropriate section on forum for this.