diff --git a/pkgs/default.nix b/pkgs/default.nix
index 4a84b9c..cfd722d 100644
--- a/pkgs/default.nix
+++ b/pkgs/default.nix
@@ -26,6 +26,8 @@ pkgs.lib.makeScope pkgs.newScope (pkgs: {
 
   osc52 = pkgs.callPackage ./osc52 { };
 
+  rbw-pass = pkgs.callPackage ./rbw-pass { };
+
   unbound-zones-adblock = pkgs.callPackage ./unbound-zones-adblock { };
 
   unified-hosts-lists = pkgs.callPackage ./unified-hosts-lists { };
diff --git a/pkgs/rbw-pass/default.nix b/pkgs/rbw-pass/default.nix
new file mode 100644
index 0000000..7f0286b
--- /dev/null
+++ b/pkgs/rbw-pass/default.nix
@@ -0,0 +1,40 @@
+{ lib, coreutils, makeWrapper, rbw, rofi, stdenvNoCC }:
+stdenvNoCC.mkDerivation rec {
+  pname = "rbw-pass";
+  version = "0.1.0";
+
+  src = ./rbw-pass;
+
+  nativeBuildInputs = [
+    makeWrapper
+  ];
+
+  dontUnpack = true;
+
+  dontBuild = true;
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp $src $out/bin/${pname}
+    chmod a+x $out/bin/${pname}
+  '';
+
+  wrapperPath = lib.makeBinPath [
+    rbw
+    coreutils
+    rofi
+  ];
+
+  fixupPhase = ''
+    patchShebangs $out/bin/${pname}
+    wrapProgram $out/bin/${pname} --prefix PATH : "${wrapperPath}"
+  '';
+
+  meta = with lib; {
+    description = "A simple script to query a password from rbw";
+    homepage = "https://git.belanyi.fr/ambroisie/nix-config";
+    license = with licenses; [ mit ];
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ ambroisie ];
+  };
+}
diff --git a/pkgs/rbw-pass/rbw-pass b/pkgs/rbw-pass/rbw-pass
new file mode 100755
index 0000000..90e916c
--- /dev/null
+++ b/pkgs/rbw-pass/rbw-pass
@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+
+usage() {
+    printf '%s\n' "Usage: bw-pass [directory name] <account name>" >&2
+}
+
+error_out() {
+    printf '%s\n' "$1" >&2
+    rofi -dmenu -no-fixed-num-lines -p "$1"
+    exit 1
+}
+
+ensure_logged_in() {
+    rbw login
+}
+
+query_password() {
+    # Either use with `query_password <directory> <account name>
+    # Or `query_password <account name>` when the account has no directory
+
+    local FOLDER_ARGS=()
+    local PASSWORD
+
+    # FIXME: no way to enforce filering by "no folder"
+    if [ $# -eq 2 ]; then
+        FOLDER_ARGS+=(--folder "$1")
+        shift
+    fi
+    PASSWORD="$(rbw get "${FOLDER_ARGS[@]}" "$1")"
+
+    if [ -z "$PASSWORD" ]; then
+        error_out "Did not find password for '$1'"
+    fi
+    printf '%s\n' "$PASSWORD"
+}
+
+if [ $# -lt 1 ] || [ $# -gt 2 ]; then
+    usage
+    exit 1
+fi
+
+ensure_logged_in
+query_password "$@"