diff --git a/README.md b/README.md
index d47c3b5..18a674e 100644
--- a/README.md
+++ b/README.md
@@ -39,6 +39,8 @@ My personal NixOS system configuration.
 
 Passwords of 5-15 words or 12-64 characters, "did you mean" for typos, "stay unlocked" for a few minutes (kernel keyring), encrypted export/import shared with the NexoPass Android app, and `nexopass settings`. Run `nexopass help` for everything else. Apache License 2.0.
 
+`nexopass-gui` is the [NexoPass](https://github.com/Nexoniarz/NexoPass) window (also on Android and Windows), fetched from its GitHub release. It uses the same files as `nexopass`, so both see the same accounts and app password.
+
 ---
 
 *Made by **Nexoniarz***
diff --git a/modules/scripts.nix b/modules/scripts.nix
index 292706f..2f830f4 100644
--- a/modules/scripts.nix
+++ b/modules/scripts.nix
@@ -1,14 +1,39 @@
-{ config, pkgs, ... }:
+{ config, pkgs, lib, ... }:
 
 let
   vaultToggle = pkgs.writeShellScriptBin "vault-toggle" (builtins.readFile ./scripts/vault-toggle.sh);
   stripMetadata = pkgs.writeShellScriptBin "strip-metadata" (builtins.readFile ./scripts/strip-metadata.sh);
+
   nexopass = pkgs.writeShellApplication {
     name = "nexopass";
     runtimeInputs = with pkgs; [ libargon2 gnupg wl-clipboard keyutils coreutils gnused ];
     runtimeEnv.NEXOPASS_WORDLIST = "${./scripts/eff_large_wordlist.txt}";
     text = builtins.readFile ./scripts/nexopass.sh;
   };
+
+  # NexoPass window (github.com/Nexoniarz/NexoPass). Shares accounts, site
+  # lists and the app password with the nexopass command above.
+  nexopassGuiVersion = "1.3.1";
+  nexopassGuiJar = pkgs.fetchurl {
+    url = "https://github.com/Nexoniarz/NexoPass/releases/download/v${nexopassGuiVersion}/NexoPass-linux-x64-${nexopassGuiVersion}.jar";
+    hash = "sha256-WeUixuz+aLPsMDj+a0Gs09gfikMYYCf8uuZIN89CqVo=";
+  };
+  nexopassGuiLibs = with pkgs; [ libGL libx11 libxext libxrender libxtst libxi libxrandr libxcursor fontconfig freetype ];
+  nexopassGuiDesktop = pkgs.makeDesktopItem {
+    name = "nexopass";
+    desktopName = "NexoPass";
+    comment = "Passwords derived from a master";
+    exec = "nexopass-gui";
+    icon = "nexopass";
+    categories = [ "Utility" "Security" ];
+  };
+  nexopassGui = pkgs.runCommand "nexopass-gui-${nexopassGuiVersion}" { nativeBuildInputs = [ pkgs.makeWrapper ]; } ''
+    makeWrapper ${pkgs.jdk17}/bin/java $out/bin/nexopass-gui \
+      --add-flags "-Xmx1g -jar ${nexopassGuiJar}" \
+      --prefix LD_LIBRARY_PATH : /run/opengl-driver/lib:${lib.makeLibraryPath nexopassGuiLibs}
+    install -Dm644 ${./scripts/nexopass.png} $out/share/icons/hicolor/512x512/apps/nexopass.png
+    install -Dm644 ${nexopassGuiDesktop}/share/applications/nexopass.desktop $out/share/applications/nexopass.desktop
+  '';
 in
 {
   environment.systemPackages = with pkgs; [
@@ -17,5 +42,6 @@ in
     vaultToggle
     stripMetadata
     nexopass
+    nexopassGui
   ];
 }
diff --git a/modules/scripts/nexopass.png b/modules/scripts/nexopass.png
new file mode 100644
index 0000000..5531368
Binary files /dev/null and b/modules/scripts/nexopass.png differ