PAPERKEY(1)

💖 PAPERKEY — like, the manual page, bestie 💖

okay so you found yourself in the General Commands Manual section, staring at paperkey, and honestly? this one's a baddie. it's the tool that goes "hey bestie, what if your secret key lived on actual paper" and it's right. let's get into it 💅

---

✨ NAME ✨

paperkey — extract secret information out of OpenPGP secret keys 🎀

---

🌸 SYNOPSIS 🌸

paperkey [--secret-key=FILE] [--output=FILE] [--output-type=base16|raw]
[--output-width=WIDTH]

paperkey --pubring=FILE [--secrets=FILE] [--input-type=auto|base16|raw]
[--output=FILE] [--ignore-crc-error] [--comment=STRING] [--file-format]

paperkey --version

---

🦋 MOTIVATION 🦋

okay so real talk. all data should be backed up. but secret keys?? bestie, secret keys need to be backed up even harder than everything else, because if you lose them they are literally impossible to recreate. every file that was encrypted to a lost key is forever (or at least for a really long time) undecipherable. gone. poof. 💀

so yeah, obviously keep backups of your secret key info on digital media — USB sticks, CDs, whatever — but it's also super reasonable to keep an if-all-else-fails copy on plain old paper, for the day your digital media becomes unreadable for whatever reason. and like, stored properly, paper keeps information for several decades or longer. paper is that girl fr fr 🫶

here's the thing though. with GnuPG, PGP, or other OpenPGP implementations, the secret key usually holds a LOT more than just the secret numbers that actually matter. it also has all the public values of key pairs, user ids, expiration times, and more. and since the goal is to minimize the info that has to be entered manually or with the help of OCR, QR code, or similar software, paperkey extracts just the secret information out of OpenPGP secret keys. recovering a secret key assumes the public key is still available — for instance from public Internet keyservers. no cap 👑

---

💜 DESCRIPTION 💜

paperkey has two modes of operation:

the first mode creates "paperkeys" by extracting just the secret information from a secret key, formatting the data in a way suitable for printing, or in a raw mode for further processing. ✨

the other mode rebuilds secret keys from such a paperkey plus a copy of the public key, and it also verifies the checksums embedded in the paperkey. this mode is selected when the --pubring option is used, which is required in that case. if a passphrase was set on the original secret key, the same passphrase is set on the rebuilt key. 🔐

input is read from standard-in except when the --secret-key or --secrets option is used; output is printed to standard-out, unless changed with the --output option.

---

🔒 SECURITY CONSIDERATIONS 🔒

bestie, read this one. seriously. 🙈

please note that paperkey does not change the protection and encryption status of and security requirements for storing your secret key. if the secret key was protected by a passphrase, so is the paperkey. if the secret key was unprotected, the paperkey will not be protected either. it's giving "same energy, same consequences" 💀

---

⭐ OPTIONS ⭐

• --help, -h — display a short help message and exit successfully. cute and quick 💖
• --version, -V — print version information and copyright information and exit successfully. 👑
• --verbose, -v — print status and progress information to standard-error while processing the input. repeat it for even more output. the way that more -v = more yapping 😭
• --output=FILE, -o — redirect output to the file given instead of printing to standard-output. 📁
• --comment=STRING — include the specified comment in the base16 output. ✍️
• --file-format — paperkey automatically includes the file format it uses as comments at the top of the base16 output. this command simply prints out the file format and exits successfully. 🌈

---

🔥 OPTIONS FOR EXTRACTING SECRET INFORMATION 🔥

• --output-type=base16, --output-type=raw — select the output type. the base16 style encodes the information in the style of a classic hex-dump, including line numbers and per-line CRC checksums, to facilitate localizing errors in the input file during the recovery phase. the raw, or binary, mode is just a raw dump of the secret information, intended for feeding to barcode generators or the like. 🎀
• --output-width=WIDTH — choose line width in the base16 output mode. the default is 78 characters. 📏
• --secret-key=FILE — file to read the secret key from. if this option is not given, paperkey reads from standard-input. 🗝️

---

🧚 OPTIONS FOR RE-CREATING PRIVATE KEYS 🧚

• --input-type=auto, --input-type=base16, --input-type=raw — specify that the given input is either in base16 format, as produced by paperkey, or in raw format. the default, auto, tries to automatically detect the format in use. 🕵️‍♀️
• --pubring=FILE — file to read public key information from. it is assumed that the user can get the public key from sources like public Internet keyservers. 🌐
• --secrets=FILE — file to read the extracted secrets, the paperkey, from. if this is not given then the information is read from standard-input. 📜
• --ignore-crc-error — do not reject corrupt input and continue despite any CRC errors. ⚠️ (it's literally in the name, bestie — you're telling it to keep going even when the checksums say something's wrong)

---

🌟 EXAMPLES 🌟

take the secret key in key.gpg and generate a text file to-be-printed.txt that contains the secret data:

$ paperkey --secret-key my-secret-key.gpg --output to-be-printed.txt

take the secret key data in my-key-text-file.txt and combine it with my-public-key.gpg to reconstruct my-secret-key.gpg:

$ paperkey --pubring my-public-key.gpg --secrets my-key-text-file.txt
--output my-secret-key.gpg

if --output is not specified, the output goes to stdout. if --secret-key is not specified, the data is read from stdin so you can do things like:

$ gpg --export-secret-key my-key | paperkey | lpr

periodt. that last one is a whole pipeline and it ate 💅

---

🫶 SEE ALSO 🫶

gpg(1), http://www.jabberwocky.com/software/paperkey/

---

💌 AUTHORS 💌

paperkey is written by David Shaw <dshaw@jabberwocky.com>.

---

and that's the whole page, bestie!! this one is from June 2012 and it's part of the paperkey source, so go print your secrets on paper like the icon you are. mwah 💋 🎀✨🦋