SQ(1)

💖 sq-encrypt — encrypt a message, bestie 💖

okay so this is the sq-encrypt page from the SQ(1) manual (that's "sq", the Sequoia PGP command suite, in case you were wondering 🦋). Sit down, get comfy, we're locking your messages UP. 🔒✨

---

🌸 NAME 🌸

sq-encrypt — Encrypt a message

---

✨ SYNOPSIS ✨

sq encrypt [OPTIONS] FILE

---

💜 DESCRIPTION 💜

Encrypt a message. That's it, that's the whole vibe. 💅

But fr fr, you can encrypt a message for any number of recipients AND with any number of passwords at the same time, and optionally sign the message while you're at it. Multitasking icon behaviour, no cap. 👑

The converse operation — the reverse glow-up — is sq decrypt.

sq encrypt respects the reference time set by the top-level --time argument. It uses that reference time when selecting encryption keys, and it sets the signature's creation time to the reference time. So basically the clock you pick is the clock everybody sees. ⏰

---

🎀 OPTIONS 🎀

🧚 Subcommand options

• --binary — Emit binary data.
• --compression=KIND — Select compression scheme to use.

[default: pad]

[possible values: none, pad, zip, zlib, bzip2]

• --encrypt-for=PURPOSE — Select what kind of keys are considered for encryption.

[default: universal]

[possible values: transport, storage, universal]

• --for=FINGERPRINT|KEYID — Use certificates with the specified fingerprint or key ID.
• --for-email=EMAIL — Use certificates where a user ID includes the specified email address.
• --for-file=PATH — Read certificates from PATH.
• --for-self — Encrypt the message for yourself.

This adds the certificates listed in the configuration file under encrypt.for-self to the list of recipients. This can be used to make sure that you yourself can decrypt the message.

Currently, the list of certificates to be added is empty. (yes, empty. it's giving "placeholder era". 🙈)

• --for-userid=USERID — Use certificates with the specified user ID.
• --output=FILE — Write to FILE or stdout if omitted.

[default: -]

• --profile=PROFILE — Select the default OpenPGP standard for the encryption container.

When encrypting for certificates, the encryption container is selected based on the stated preferences of the recipients. However, if there is no guidance, for example because the message is encrypted only with passwords, sq falls back to this profile.

As OpenPGP evolves, new versions will become available. This option selects the version of OpenPGP to use for encrypting messages if the version can not be inferred otherwise.

Currently, sq supports two profiles: RFC9580 and RFC4880. Currently, the default is RFC4880. However, once support for RFC9580 is rolled out further, the default will change in a future version of sq. 👀 (heads up bestie, your default is lowkey on borrowed time)

The default can be changed in the configuration file using the setting encrypt.profile.

[default: rfc4880]

[possible values: rfc9580, rfc4880]

• --set-metadata-filename=SET_METADATA_FILENAME — Set the filename of the encrypted file as metadata.

Do note, that this metadata is not signed and as such relying on it - on sender or receiver side - is generally considered dangerous. 🚨 Like, do not trust that little filename, okay? It has zero signature energy.

• --signature-notation NAME VALUE — Add a notation to the signature.

A user-defined notation's name must be of the form name@a.domain.you.control.org. If the notation's name starts with a !, then the notation is marked as being critical. If a consumer of a signature doesn't understand a critical notation, then it will ignore the signature. The notation is marked as being human readable.

• --signer=FINGERPRINT|KEYID — Sign the message using the key with the specified fingerprint or key ID.
• --signer-email=EMAIL — Sign the message using the key where a user ID includes the specified email address.
• --signer-file=PATH — Sign the message using the key read from PATH.
• --signer-self — Sign using your default signer keys.

This adds the certificates listed in the configuration file under sign.signer-self to the list of signer keys.

Currently, the list of keys to be added is empty. (again!! empty!! the audacity 😭)

• --signer-userid=USERID — Sign the message using the key with the specified user ID.
• --use-expired-subkey — Fall back to expired encryption subkeys.

If a certificate has only expired encryption-capable subkeys, fall back to using the one that expired last. (last one out, lights off. 🕯️)

• --with-password — Prompt to add a password to encrypt with.

When using this option, the user is asked to provide a password, which is used to encrypt the message. This option can be provided more than once to provide more than one password. The encrypted data can afterwards be decrypted with either one of the recipient's keys, or one of the provided passwords.

• --with-password-file=PATH — File containing password to encrypt the message.

Note that the entire key file will be used as the password including any surrounding whitespace like a trailing newline. 💀 so like, that newline at the end of your file? that's part of the password now. sorry.

This option can be provided more than once to provide more than one password. The encrypted data can afterwards be decrypted with either one of the recipient's keys, or one of the provided passwords.

• --without-signature — Do not sign the message. 🙅♀️
• FILE — Read from FILE or stdin if FILE is '-'.

[default: -]

🌈 Global options

See sq(1) for a description of the global options. (the lore is all over there bestie)

---

🔥 EXAMPLES 🔥

Encrypt a file for a recipient given by fingerprint.

sq encrypt --for=EB28F26E2739A4870ECC47726F0073F60FD0CBF0 \
       --signer-email=juliet@example.org document.txt

Encrypt a file for a recipient given by email.

sq encrypt --for-email=alice@example.org \
       --signer-email=juliet@example.org document.txt

like... juliet signing, alice receiving? we love a plot twist. 🫶

---

👑 SEE ALSO 👑

sq(1).

For the full documentation see <https://book.sequoia-pgp.org/>.

---

⭐ VERSION ⭐

1.5.0

---

aaaand that's the page!! version 1.5.0, brought to you by the lovely humans at Sequoia PGP (page date: 1.5.0, and the man page header/footer both say SQ(1) in case you needed the receipt 🧾✨). go encrypt something iconic, bestie. periodt. 💖🎀🦋