Skip to content

GPG Keys

Jump to bottom
Cristhian Melo edited this page Jul 20, 2026 · 1 revision

GPG Keys

rpass delegates all encryption to GnuPG. You need at least one key pair: the public key encrypts entries, the private key decrypts them.

Generate a new key

gpg --full-generate-key

Recommended settings:

  • Key type: RSA and RSA
  • Key size: 4096
  • Expiration: 1–2 years (you can extend later without losing access)
  • Name and email: used to identify the key

Tip

Use RSA 4096 if you plan to use mobile clients. ED25519 is more modern but not yet supported by all apps — see Algorithm compatibility.

Find your key ID

gpg --list-secret-keys --keyid-format LONG

Example output:

sec   rsa4096/A1B2C3D4E5F6G7H8 2024-01-01 [SC]
      ABCDEF1234567890ABCDEF1234567890A1B2C3D4
uid                 [ultimate] Alice <alice@example.com>

The key ID is A1B2C3D4E5F6G7H8 (short form) or the full 40-character fingerprint. You can also use your email address wherever rpass or GPG asks for a key ID.

What is a "recipient"?

A recipient is a GPG key that can decrypt entries in a directory. rpass stores recipient lists in .gpg-id files:

~/.password-store/.gpg-id        ← root recipients
~/.password-store/work/.gpg-id   ← recipients for work/ only

When you run rpass insert, rpass reads the nearest .gpg-id and encrypts the entry for all listed keys. Any of those private keys can decrypt it. When recipients change, rpass re-encrypts all affected entries automatically.

Manage recipients

rpass recipients                              # list current recipients
rpass recipients add teammate@example.com     # re-encrypts all entries
rpass recipients remove teammate@example.com  # re-encrypts all entries
rpass recipients --path work add bot@ci.com   # scoped to work/ only

Export and import your key across devices

This is the key step for using your store on multiple devices or with mobile clients.

Export

# Public key (safe to share)
gpg --export --armor alice@example.com > public-key.asc

# Private key — required to decrypt your store on another device
gpg --export-secret-keys --armor alice@example.com > private-key.asc

Warning

private-key.asc gives full access to your encrypted store. Delete it from temporary locations (email, shared drives, cloud uploads) immediately after the import is complete.

Import on another device

gpg --import public-key.asc
gpg --import private-key.asc

# Mark as trusted — required to encrypt without warnings
gpg --edit-key alice@example.com
# Inside the gpg prompt:
# > trust → 5 (ultimately trusted) → quit

Verify: gpg --list-secret-keys alice@example.com

Transfer methods for mobile clients

Method Works with
AirDrop / Files app PassForiOS
Paste ASCII-armored text PassForiOS, Android Password Store
OpenKeychain import Android Password Store
QR code (via asc-key-to-qr-code-gif) PassForiOS
Temporary HTTPS URL (via gpg-serve-key) PassForiOS

Algorithm compatibility for mobile clients

Not all clients support every key type. Check this before generating or importing a key.

PGP key algorithms

Algorithm rpass Pass for iOS Android Password Store
RSA 4096 ✓ ✓ ✓
RSA 2048 ✓ ✓ ✓
ED25519 ✓ ✗ ✓

Important

Pass for iOS does not support ED25519 PGP keys. If you use or plan to use PassForiOS, generate an RSA key instead.

SSH key algorithms (for Git authentication)

Algorithm Pass for iOS
RSA 2048 ✓
ECDSA ✓
ED25519 ✓

SSH key format

Warning

Pass for iOS does not support the newer OpenSSH private key format (files starting with -----BEGIN OPENSSH PRIVATE KEY-----). Use the PEM format instead.

Generate a compatible SSH key:

ssh-keygen -t rsa -b 4096 -m PEM -f ~/.ssh/id_rsa_passforios

Or convert an existing key with puttygen:

puttygen existing-key -O private-openssh -o pass_for_ios.key

Share your store with a teammate

  1. Ask your teammate for their public key and import it:

    gpg --import teammate-public-key.asc
# or from a keyserver:
gpg --keyserver keys.openpgp.org --recv-keys THEIR_FINGERPRINT

  2. Add them as a recipient (rpass re-encrypts all entries automatically):

    rpass recipients add teammate@example.com

  3. Push the updated store:

    rpass git push

Your teammate clones the repo and uses their own private key to decrypt — they never need yours.

Key expiration

When your key expires, extend it without re-encrypting your store:

gpg --edit-key alice@example.com
# > key 0 → expire → 2y → save

Backup checklist

  • private-key.asc stored offline (USB drive, encrypted backup)
  • GPG passphrase stored separately (password manager, paper)
  • public-key.asc uploaded to a keyserver or shared with teammates
  • Store repository pushed to a remote Git host

Clone this wiki locally