I have a GNUPG file that i use to store all my passwords locally(Dont know if it is a good idea). The question is, is it safe to push the GNUPG file to github so i can access it from anywhere?

  • 3
    Is is safe from what? What are you concerned about?
    – schroeder
    Aug 29, 2018 at 10:23

2 Answers 2


It's encrypted, so in theory it's safe, provided your encryption key/password is of sufficient quality.

But if you're making your database public, that's pretty much an invitation for people to try cracking it. If your key is not as strong as you think, or if you slip up in some other way (falling for a phishing attack for example), then you are at risk. I think posting your database publicly is a bad idea. Just because something shouldn't be at risk if it's in the hands of attackers, doesn't mean you should volunteer to be a target. Just like a website keeps its password hashes private as a first line of defense, your first line of defense should be keeping your password file out of the hands of attackers. They can't even try to attack what they don't have yet.

I suggest using an online storage service that offers private access (such as: Dropbox, Google Drive, OneDrive, etc.) to store your encrypted passwords for convenient multi-device access but still keep them hidden from most attackers.

Off-topic: have you considered a password manager designed for the purpose? If you want a local-only tool, KeePass, PasswordSafe, and other options exist. I think you'll find the convenience increases quite a bit with the same level of security (or better, as you you don't need to worry about temporary files created on decryption).

  • Thank you for your suggestions. I was willing to do this project as a simple password manager with git or git like integration. I sometimes also need access to these passwords on servers hence i was looking for a CLI interface. How about using a private git repo like bit bucket which is free for small user groups ? Aug 29, 2018 at 16:46
  • I'm sure private repo should be fine; it's still important to make sure to use a strong key but at least it's not publicly available for attack unless your Bitbucket account gets compromised.
    – Ben
    Aug 29, 2018 at 19:51
  • 1
    Not posting your private key in public is not security through obscurity...
    – forest
    Sep 4, 2018 at 8:08
  • You're right, "not posting your private key in public" is not security through obscurity. Arguably not posting your encrypted database publicly could be considered security through obscurity, since in theory the encryption should protect the database all by itself. I rephrased to make it clearer what I was talking about. It's more "defense in depth" than "security through obscurity", but at the same time in theory it should be safe to publish an encrypted database, it's just not a great idea, which is what I was trying to communicate.
    – Ben
    Sep 4, 2018 at 21:14
  • @forest, thinking about this some more, you're correct. I've removed the "security through obscurity" line and rephrased to reflect the point I was actually trying to make.
    – Ben
    Sep 6, 2018 at 15:02

The pass password manager works in essentially the way you are proposing by putting each password (plus optional additional information) in an individual PGP encrypted file and checking it into git in order to move it around. While it isn't the most popular password manager it is popular enough that if this caused serious problems it would probably be known.

I use pass myself although I use an ssh account (authenticated via gpg-agent and my PGPCard) on a rented personal VM rather than github although all this does is hide the filenames, named after the sites for which they are used, which pass uses and wouldn't really make a difference for your all in one file scenario.

  • I dont know who voted this down, but pass it a great interface to gpg encrypted passwords. Can stick the pass directory into dropbox or google drive etc. Upvoted.
    – RichieHH
    Jan 21, 2021 at 11:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .