I get confused about the terms used in the output of gpg --list-secret-keys

For example what is the meaning of following:

sec sec# ssb ssb>

there are many codes being used in the output. Can anyone point to the official docs where everything is explained?

I found this link but nothing is explained there.

3 Answers 3


Another info source is the DETAILS file in the GnuPG distribution.

Section "Field 1 - Type of record" states

Field 1 - Type of record

Public key

X.509 certificate

X.509 certificate and private key available

Subkey (secondary key)

Secret key

Secret subkey (secondary key)

User id

User attribute (same as user id except for field 10).


Revocation signature

Revocation signature (standalone) [since 2.2.9]

Fingerprint (fingerprint is in field 10)

Public key data [*]


Revocation key

TOFU statistics [*]

Trust database information [*]

Signature subpacket [*]

Configuration data [*]

Records marked with an asterisk are described at *Special fields.
  • [sec] - The following is a secret key
  • [ssb] - The following is a secret sub key

The meaning of # after each of these is that the key is not usable, if say, you used the export subkeys option or if the key is otherwise taken "offline".

The meaning of > is that the key is stored on something like a smart card.

You can find more info here at Ubuntu's man page for GPG and the documentation you reference has been moved to here at GnuPG.org.

  • 1
    Thanks for the answer. Is there place where I can see the detailed description of these codes? I couldn't find anything on both the urls you mentioned. I searched for 'ssb'
    – theguru42
    Commented Jun 23, 2017 at 9:16
  • @zaphod TBH I think the gnupg documentation is still lacking. Probably because they are moving to a new documentation format (which in the open source community can take a while). However I remembered a great walk-through by void. You can find it here: void.gr/kargig/blog/2013/12/02/… Read up on this and by the end you'll get it all. It should do in place of the documentation until they get that going again. The only thing it doesn't discuss is > which only means the key you are listing is on a device like a smartcard or usbkey or something.
    – Nalaurien
    Commented Jun 23, 2017 at 9:54
  • I asked about the official docs at dev.gnupg.org/T1563#122298
    – Ben Creasy
    Commented Feb 5, 2019 at 6:19

Based on in the information I have gathered:

On using command gpg -K which lists secret keys:

sec: the master/primary secret key. There is key size, keyid, creation date, expiration date and fingerprint information displayed.

ssb: secret subkeys. These can be your sub signing key, encryption key or authentication key. You can have multiple subkeys.

uid: this is the user information associated with the secret key. You can have multiple uids.

sec#: # after sec means that your secret key is missing from the machine. But it has a reference to the secret key.

ssb>: > after ssb means that your subkeys are not the machine. Instead they are on a smartcard.

On using command gpg -k which lists public keys:

pub: your public key info.

sub: your public subkey info.

If you have any other information which is missing. Please edit the answer or leave a comment.

Thanks to @Nalaurien for the previous answer.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .