I assume that GPG is very strong to crack, guess, etc. Since I have confidence in GPG, would it be appropriate to use my GPG key as the master key for a password manager or generator?
GPG encrypts your data with a symmetric key, then encrypts that symmetric key with / for the public / private keypair. That keypair is usually kept safe by symmetrically encrypting it.
What you're asking for is a program that would diagram as such:
What you should use is a password manager that does the following step:
The job of a password manager is as much one of not placing your data in cleartext as it is simplicity. GPG's job is to allow communication of a key exchange across a clear channel. Since you'll be the only one encrypting / decrypting your passwords, symmetric encryption is just fine. Cryptographically speaking. GPG uses OpenSSL for the backend anyway as a great number of freely available password managers most likely do.
Now, with all that said, it makes good sense to do this on your computer if your GnuPG key is held on an external smartcard, and it'd work with a phone if there were an NFC version of the card. You could use git for synching various password files.
I'll start with the quick answer to your question (which has two parts). First off, yes, GPG is suitable as a password manager in terms of having strong encryption. It is very unlikely (most would say impossible) that the password would get cracked using asymmetric encryption.
The second part of the answer is that, no, it's probably not suitable as a password manager. Having to manage keys can be irritating if you're using several machines, and if you lose your private key, you're liable to have to reset many, many passwords--a real pain.
The quick solution to the key management problem is to use
I'm not going to go into the full details of my current setup, but I can outline it quickly: rather than using
I tend to prefer something like this:
Yes, and in fact there is such a password manager, that uses gpg for the encryption. It's called