I use KeePass with two factors, one being a keyfile. I would like to print the keyfile on a paper for disaster recovery.

How can I create a file that is printable on paper in such a way that I can use it to recover the keyfile? I surely have to take care that only printable characters are used, but are there more gotchas to this?

Edit: To rephrase the question, is there any difference between a paper key and a paper keyfile? I believe the used file system is transparent to the file and with redirecting the output on linux using > operator I should be able to create a file containing 1:1 what was read from my preferred source of entropy. In term of ease of recovery, QR-Code and similar (Data Matrix?) might be acceptable.

a) Am I missing something? b) In comments somebody linked a tool (thx!) are there more handy / widespread ones? I would prefer to not need to install a python environment to be able to create a paper keyfile.


2 Answers 2


My suggestion would be to directly print Base64 and print a QR-code of the same Base64.

The plain base64 is a tedious fallback if all else fails. You could also print it using OCR fonts for better scanning.

The QR-code provides a simple paper to digital conversion format with built in error checks. If the base64 keyfile is too large for a single QR-code, split it into multiples.

This avoids proprietary tools.


#Make a 1KB (8K bits) file of random binary data to simulate a key

dd if=/dev/urandom of=binrand.bin bs=1K count=1

#Convert binary to Base64

base64 binrand.bin > binrand.mim

#Create a QR-code where -l {LMQH} specifie error correction level from L (lowest) to H (highest). (default=L)

qrencode -l Q -r binrand.mim -o qr.png

Print Page




QR-code Example

  • 1
    I'm upvoting because of portability and proven readability/reliability in the industry. It would be nice to add a reversible shell pipeline that cut the data into chunks, fed it into qrencode and merged the png's into a single PDF in this answer. Might do the edit myself if I find the time. Oct 23, 2020 at 5:50
  • Awesome! That looks like what I have been looking for :). I think I will have no problem to figure out how to reverse the procedure, but for the sake of completeness and if others find this solution, would you mind to also show how to recover the keyfile from the qr code?
    – BernB
    Oct 23, 2020 at 7:36
  • 1
    @BernB - Most QR-code applications can recover the data. I checked it by holding my smart phone in front of the screen image and selecting the QR App. You can also feed the image to a desktop based QR-code reader. Oct 23, 2020 at 15:10
  • 1
    @BernB - A general purpose Linux barcode utility (including QR) is zbar, of which zbarimg will import a file image and decode it. Oct 23, 2020 at 19:59

I still have the best Results using the PaperBack tool. It was able to automatically recover all data I printed until now, even a more than six year old copy printed using an inkjet printer that was bleached out a bit already.

I described my exact process here. I don't trust the included encryption, so I always encrypt the files with a different software.

The tool is windows only but open source and works fine using wine.

To your question "is there any difference between a paper key and a paper keyfile?":

A keyfile can contain arbitrary binary data. You cannot print that. Even if you where to only use basic ASCII, how would you get the difference between a space character or a tab character? How would you see the difference between a windows or a unix linebreak on paper? How would you see if there was just the end of the paper reached or an actual linebreak in the data? Even if you use just visible ASCII characters, you have to make sure to know which encoding was used in the file, if there is a linebreak at the end of the file (on Unix/Linux systems it's hard to create a file without one), if yes, which linebreak, is there a BOM marker at the start of the file, ... And you either need to write all of that down or remember it when entering the data again. So I wouldn't suggest that.

To not deal with that, you need to encode the file. You can encode it to text, e.g. Base64, or to something image based. The downside of simple base64 is, that you have to use OCR or type the letters and there is no redundancy and no error check. If you misread a letter, you get a keyfile. It is just not the correct one.

Better systems solve that by having error checking and even redundancy based error correction. So even if part of your printed key is unreadable, the error will be automatically corrected and you get the correct keyfile. And if too much is damaged, you get at least the information that the print is defective and not a wrong keyfile.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .