Enpass 6.12 on Linux: fixing the X11 installation

With the move from Enpass 6.11 to 6.12, Enpass decided to rework essentially the entire desktop interface. Despite what looks like a relatively minor version change, Enpass describes 6.12 itself as having been “redesigned from the ground up”, including layouts, settings, workflows, icons, typography, and most other parts of the interface.

Unfortunately, that change has also introduced plenty of issues.

On my Linux/X11 setup, a normal update through apt upgrade resulted in Enpass no longer starting. The solution is to switch the Enpass APT repository to its X11-specific variant.

Once that is fixed, Enpass starts again. The new interface will still take some time to get used to.

Installing Enpass on Ubuntu/Debian with X11

The official Enpass Linux installation instructions first add the Enpass APT repository:

echo "deb https://apt.enpass.io/ stable main" | sudo tee /etc/apt/sources.list.d/enpass.list

However, if you are running X11 rather than Wayland, you need to use the X11 repository. If you don’t know your session type you can check it with echo "$XDG_SESSION_TYPE" on the shell.

For an X11 installation, run this before continuing with the signing key and package installation:

echo "deb https://apt.enpass.io/ x11 main" | sudo tee /etc/apt/sources.list.d/enpass.list

This replaces the normal stable repository entry with the x11 repository entry because both commands write to the same /etc/apt/sources.list.d/enpass.list file. Enpass’s current documentation explicitly provides this X11 repository for systems running X11.

Important: the Enpass documentation is wrong here

At the time of writing, Enpass displays the X11 command like this:

echo "deb https://apt.enpass.io/ x11 main" | sudo tee
/etc/apt/sources.list.d/enpass.list

That line break is wrong. /etc/apt/sources.list.d/enpass.list is an argument to tee and therefore belongs on the same command line:

echo "deb https://apt.enpass.io/ x11 main" | sudo tee /etc/apt/sources.list.d/enpass.list

Then import the repository signing key:

wget -O - https://apt.enpass.io/keys/enpass-linux.key | sudo tee /etc/apt/trusted.gpg.d/enpass.asc

Update APT:

sudo apt-get update

Install, or reinstall/update, Enpass:

sudo apt-get install enpass

After applying this workaround, Enpass works again on my X11 setup.

The full sequence

echo "deb https://apt.enpass.io/ x11 main" | sudo tee /etc/apt/sources.list.d/enpass.list
wget -O - https://apt.enpass.io/keys/enpass-linux.key | sudo tee /etc/apt/trusted.gpg.d/enpass.asc
sudo apt-get update
sudo apt-get install enpass

Maybe it is time to look elsewhere

I have used Enpass for more than ten years. For most of that time, it has been a very good tool.

More importantly, it has helped me maintain good password hygiene for a very long time. I don’t have to reuse memorable passwords or choose credentials that are realistically vulnerable simply because I need to remember them. A password manager has become a fundamental part of how I use computers, and Enpass has filled that role reliably for years.

Enpass isn’t a bad product. But a redesign this size doesn’t belong in a minor semver bump, and it has me wondering whether it’s time to reconsider the tool.

There are longstanding limitations alongside the new interface problems. One particularly annoying example is export: Enpass can export a vault, but not an arbitrary tag, group, or other selected subset of items.

For something as fundamental and long-lived as a password database, portability matters.

After more than a decade with Enpass, this seems like a good point to look at open-source alternatives. Enpass hasn’t become useless; I’d just prefer that something as important as a password manager, its software, data formats, migration paths, and long-term availability, didn’t depend entirely on one proprietary application.

Enpass has served me well for a very long time. That also means any replacement has quite a high bar to clear. I remember using Keepass before.