What are the methods to backup a key to paper?

The idea is to have reasonable protection and the ability to restore the key in case of the digital backup is lost.

Are there things that convert a standard PKCS key into a easy paper representation? (Example take a key and output a words or QR code maybe?)


The intended use is for less technical people to have a easy way of backing up their keys e.g. filing the paper somewhere. It should also be reasonably easy to restore.

  • QR codes are just an encoding method. You can encode any kind of text to QR – schroeder May 29 '20 at 8:56
  • Is there a reason you can't use the standard PEM / base64? If not, what would you consider "reasonably easy to restore"? – tim May 29 '20 at 19:29
  • @tim would this be applicable for non-tech people? In cryptography the weakest link is always the user. So it has to be reasonably easy e.g. fool proof (QR code?) or something else which I don't know of. Can you elaborate PEM / base64 a bit? thank you! – John May 30 '20 at 12:17

This RSqueezA sounds okay to provide QR Codes and read from them to a key file.

But: In my company non-technical people get a long (about 32 random characters) key phrase printed as-is. And then the paper will be stored in a (fire-proof) safe. Reading and typing all the characters is good and fast enough for them.

For all the other people without a safe I recommend a password manager and store the password the same way but at home at a non-work-related place. (no one would guess it's the password for their work).

  • your URL is broken, the ']' ended up as part of the href. – Pedro May 29 '20 at 12:45
  • Sorry but I voted you down for advising to store work passwords at home, as that is against most company policies and introduces unnecessary risks. – Enos D'Andrea May 31 '20 at 8:07
  • @EnosD'Andrea you are totally right. Nobody should take work passwords at home. This isn't what I meant. I mean "If and only if you decide by yourself to do this and take password backups at home (because of home / remote work) then store it there so that nobody can directly relate the note to your business device". – Johannes S Jun 1 '20 at 0:03
  • @Johannes still I wouldn't give users any evil ideas - they are already creative enough on their own. – Enos D'Andrea Jun 2 '20 at 6:46

For high security keys, some systems will export a key by outputting a specified number of “key shards”, which is an m of n set of secret values that are given to five (or however many n is) parties to independently store. When it comes time to recover the value, at least three (or however many m is) people must get together with their shards to decrypt it. This is how a HashiCorp Vault’s master key is set up. It's a classic implementation of Shamir's Secret Sharing.

Other systems use three key-length values that must be XORed together to recover a Key Encrypting Key (KEK); the KEK being used to encrypt the high security key. The KEK is exported as three parts that are printed on paper sheets; the pages are each sealed in tamper evident bags and kept in independent safes, and must all be brought back to recover the secret key. This strategy is often used for distributing a key on paper, sending the pages to three different recipients at three independent addresses via three different couriers. If any of the bags show signs of tampering, the keys are discarded before being placed in service.

Generally, these key parts are long strings of hex values, and are hard for people to enter correctly, or to know when they’ve made a mistake. It’s common to print a Key Check Value (KCV) along with each key part. A KCV serves as a six-digit checksum to help the people who are typing in these long strings; any mistake in data entry turns up as a completely different KCV value.

Finally, some keys are so sensitive that they are generated and stored in FIPS-compliant Hardware Security Modules (HSMs), which are specially constructed to prohibit their keys from being exported. HSMs are often used to store the KEKs for other security systems, such as the master keys for a key management system, a Trusted Root CA's private signing key, the unseal keys needed for a vault, etc. Instead of paper backups, a second (and/or third, fourth, or fifth) HSM is used as a dedicated backup system. This backup HSM is kept offline in a safe, and is only trotted out to make the occasional backup or recovery. A backup HSM can only restore its KEK to an authorized replacement HSM. Such systems are usually proprietary and vendor dependent.


In my opinion we can learn from the standards that evolved in the area of cryptocurrencies in the past years:

BIP39 is a standard that converts a secret key to a seed phrase (and vice versa):
mnemonics that are easy to read/write for humans (e.g. short English words that represent a set of bits).
See https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki

I guess that would match your use case. Basic error correction is accomplished by the fact that you wouldn't mistype a word that you know in your own native language.

  • This is what I was looking for! Thank you very much @lab9! :) – John Jun 6 '20 at 9:56
  • @John, you're welcome. Feel free to mark this as the correct answer if you like. – lab9 Jun 6 '20 at 10:48

I would recommend using a password manager with notes encryption feature. It's much safer than plain paper and easy to use. Especially password managers on Android or iOS. Those mobile operating systems sandbox every app, better than desktop systems.

Disclaimer: I write ID Guard Offline, a password manager.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.