SQ(1)

💖 SQ-DECRYPT — it's giving "unlock the tea" ✨

okay bestie, welcome to the sq-decrypt page from the SQ(1) user commands manual 💅 she's the one who cracks open encrypted messages, and she is lowkey a whole vibe. also hi, we're in section 1 of the manual, keeping it cute, keeping it canonical 🎀

---

🌸 NAME 🌸

sq-decrypt — decrypt a message 🦋

---

✨ SYNOPSIS ✨

sq decrypt [OPTIONS] FILE

---

💜 DESCRIPTION 💜

Decrypt a message. That's it, that's the job, no cap 💖

She'll decrypt a message using either the keys you hand her, or by prompting you for a password 🔑 Whichever way you go, if message tampering is detected, an error gets returned — see the deets below, bestie, don't skip them.

If certificates are supplied using the --signer-file option, any signatures that are found get checked against those certificates 👑 Verification only succeeds if there is no bad signature and the number of successfully verified signatures reaches the threshold you configured with the --signatures parameter. It's giving "strict queen energy".

If signature verification fails, or if message tampering is detected, the program terminates with an exit status indicating failure 😭 and the output file gets deleted. Not archived, not backed up, deleted. And if the output was sent to stdout instead, then the last 25 MiB of the message are withheld — which consequently means if the message is smaller than 25 MiB, no output is produced at all. Fr fr, plan accordingly.

⚠️ tampering detected = failure exit status, output file gone, or last 25 MiB of stdout withheld. she is not playing around, bestie 💀

The converse operation is sq encrypt 🔁 (yes, they're besties, obviously).

---

🌈 OPTIONS 🌈

🎀 Subcommand options 🎀

• --dump-session-key — print the session key to stderr 🔍 like a little sneak peek, just for you.
• --output=FILE — write to FILE, or to stdout if you leave it out.
  • [default: -]
• --recipient-file=KEY_FILE — decrypt the message using the key in KEY_FILE 🔑 that's your secret key file, girly.
• --session-key=SESSION-KEY — decrypt an encrypted message using SESSION-KEY 🗝️
• --signatures=N — set the threshold of valid signatures to N 🧮
  • The message will only be considered verified if this threshold is reached.
  • [default: 1 if at least one signer cert file is given, 0 otherwise]
• --signer=FINGERPRINT|KEYID — require a signature from a certificate with the specified fingerprint or key ID 👑
• --signer-domain=DOMAIN — require a signature from a certificate where a user ID includes an email address for the specified domain 📧
• --signer-email=EMAIL — require a signature from a certificate where a user ID includes the specified email address 💌
• --signer-file=PATH — require a signature from a certificate read from PATH 📂
• --signer-userid=USERID — require a signature from a certificate with the specified user ID 🪪
• FILE — read from FILE, or from stdin if FILE is '-' 📥
  • [default: -]

🫶 Global options 🫶

See sq(1) for a description of the global options — she's the main character, go say hi 💖

---

🔥 EXAMPLES 🔥

Decrypt a file using a secret key 🔑✨

sq decrypt --recipient-file juliet-secret.pgp ciphertext.pgp

Decrypt a file verifying signatures 📝👀

sq decrypt --recipient-file juliet-secret.pgp --signer-file \
       romeo.pgp ciphertext.pgp

decrypt a file using the key store 🏪💅

sq decrypt ciphertext.pgp

(not the lowercase example heading, that's just how she came, and we respect her 🫡)

---

🌟 SEE ALSO 🌟

sq(1).

For the full documentation see <https://book.sequoia-pgp.org/> 📚

---

💫 VERSION 💫

1.5.0

---

okay bestie that's the whole page, you ate it up 🍓 anyway, this masterpiece was brought to you by Sequoia PGP and she's sitting pretty at version 1.5.0, dated right there in the footer — so go forth, decrypt responsibly, and remember: verify then trust, never the other way around 💜🧚✨