I assume that GPG is very strong to crack, guess, etc. Since I have confidence in GPG, would it be appropriate to use my GPG key as the master key for a password manager or generator?

  • why vote down? noobish question?
    – dzervas
    Mar 5, 2013 at 15:07
  • There is no practical usage for using your private key to decrypt a password manager with GPG. Plus it sounds like a product recommendation. Mar 5, 2013 at 15:09
  • It sounds clever and secure to me. What's wrong with product recommendation? I've seen other questions about password managers etc.
    – dzervas
    Mar 5, 2013 at 15:11
  • @ttouch Ah see, that to me part is the key point.
    – user10211
    Mar 5, 2013 at 15:13
  • 4
    Well, it makes some sense. GPG is a trusted, vetted product that you have a reliance on. That's one of the greater tenets in choosing a security product. This is why we seek experts to answer these questions, because unless you've spent a lot of time and are well-versed, that's all you have to rely on. So, after some thought, +1 from me.
    – Jeff Ferland
    Mar 5, 2013 at 15:26

4 Answers 4


GPG encrypts your data with a symmetric key, then encrypts that symmetric key with / for the public / private keypair. That keypair is usually kept safe by symmetrically encrypting it.

What you're asking for is a program that would diagram as such:

Symmetric -> Asymmetric -> Symmetric

What you should use is a password manager that does the following step:


The job of a password manager is as much one of not placing your data in cleartext as it is simplicity. GPG's job is to allow communication of a key exchange across a clear channel. Since you'll be the only one encrypting / decrypting your passwords, symmetric encryption is just fine. Cryptographically speaking. GPG uses OpenSSL for the backend anyway as a great number of freely available password managers most likely do.

Now, with all that said, it makes good sense to do this on your computer if your GnuPG key is held on an external smartcard, and it'd work with a phone if there were an NFC version of the card. You could use git for synching various password files.

  • So, lets say I have a simple setup (bash script) that just encrypts my passwords in files and decrypts them. Should I use AES (maybe with many iterations) or GPG? Which is more secure?
    – dzervas
    Mar 27, 2015 at 1:17

I'll start with the quick answer to your question (which has two parts). First off, yes, GPG is suitable as a password manager in terms of having strong encryption. It is very unlikely (most would say impossible) that the password would get cracked using asymmetric encryption.

The second part of the answer is that, no, it's probably not suitable as a password manager. Having to manage keys can be irritating if you're using several machines, and if you lose your private key, you're liable to have to reset many, many passwords--a real pain.

The quick solution to the key management problem is to use gpg -c, which allows you to use symmetric encryption with gpg using a passphrase. This is great, but now we're getting into the territory of what I'd actually recommend for an alternate solution since you're not actually using the primary benefit of GPG anymore (public/private keys).

I'm not going to go into the full details of my current setup, but I can outline it quickly: rather than using gpg to manage a text file of credentials, I use openssl. The reasoning behind this is simple: almost every Linux (and, I believe, OS X) system comes pre-installed with openssl. It's universal, which makes portability very easy if I'm carrying my encrypted file around with me on a flash drive (a copy of it, of course). There are no keys to manage, and I can easily choose which encryption method to use.

I tend to prefer something like this: openssl aes-256-cbc -salt -in passwords.txt -out passwords.aes to encrypt my password database. Don't forget to rm the plaintext! From there, I can easily just run openssl aes-256-cbc -d -in passwords.aes and grep for the creds I'm using. Adding things can get a little bit trickier--I generally have to print out to stdout, or append a temp file then re-encrypt--but it's worth it to me for the portability that openssl provides.

  • very smart! is the aes strong enough?
    – dzervas
    Mar 6, 2013 at 13:43
  • AES-256-CBC should be strong enough for any feasible purpose. The real risk would lie in brute-forcing the password, rather than breaking the crypto itself. Using a long, complicated passphrase is the way to go on this one.
    – dshaw
    Mar 7, 2013 at 23:47
  • Is it stronger than GPG? Also, a note about portability: Do not EVER decrypt your passwords on PCs that are not entirely yours. Reading the memory/keyboard/usb drive is very easy and one could steal your encrypted keys AND your key.
    – dzervas
    Mar 27, 2015 at 1:19
  • One advantage of using gpg in this setting is that it authenticates the encrypted files and can detect if the encrypted file gets corrupted or tampered with. Openssl, on the other hand, only encrypts the file.
    – hugomg
    Jul 21, 2017 at 20:33

Yes, and in fact there is such a password manager, that uses gpg for the encryption. It's called pass, and it's available at http://www.passwordstore.org/ for linux/Unix.

With pass, each password lives inside of a gpg encrypted file whose filename is the title of the website or resource that requires the password. These encrypted files may be organized into meaningful folder hierarchies, copied from computer to computer, and, in general, manipulated using standard command line file management utilities.

pass makes managing these individual password files extremely easy. All passwords live in ~/.password-store, and pass provides some nice commands for adding, editing, generating, and retrieving passwords. It is a very short and simple shell script. It's capable of temporarily putting passwords on your clipboard and tracking password changes using git.

You can edit the password store using ordinary unix shell commands alongside the pass command. There are no funky file formats or new paradigms to learn. There is bash completion so that you can simply hit tab to fill in names and commands, as well as completion for zsh and fish available in the completion folder. The community has even produced a GUI client, an Android app, an iOS app, a Firefox plugin, a dmenu script, and even an emacs package.

  • 2
    Yea, I'm currently testing it, but I'm not sure if GPG encryption is more suitable than AES or Serpent...
    – dzervas
    Mar 27, 2015 at 1:20
  • 1
    Under the hood, GPG is using AES or a similar symmetric cipher for the bulk of the encryption. A random session key is generated for the symmetric algorithm, and that key is encrypted using RSA or other asymmetric encryption. Mar 27, 2015 at 18:25

To read my passwords I use an encrypted file in my home directory. To decrypt it, I simply use the decrypt command of GnuPG, covered in a nice shell script rpw (for read passwords) - it then asks me for a pass-phrase and displays all my passwords in the terminal. Optional, I can give a search term like e.g. rpw ebay. Then only the line, where 'ebay' appears, when I give out the passwords. Please find my script from /usr/local/bin/rpw here:

gpg -d -o - /home/USER/pw.gpg | grep "$1" 

To write/ edit the password file, I decrypt it, edit it, and then encrypt it again, while wiping the decrypted file. Here is this script, which is called wpw (for write passwords). /usr/local/bin/wpw:

gpg -d -o /home/USER/pw_unenc /home/USER/pw.gpg
vi /home/USER/pw_unenc
gpg -o /home/USER/pw.gpg -e /home/USER/pw_unenc
wipe -f -s /home/USER/pw_unenc

This is all very easy and relies on GnuPG's security.

  • 1
    There be a Vim plug for editing encrypted files. It may also be possible to have Vim read from standard-in with gpg -d -o - /home/USER/pw.gpg | vim - and when done editing, run the encryption command during Vim's write process with :w !gpg --encrypt > /home/USER/pw.gpg then quit without re-saving Vim's buffer with :q! ... though the aforementioned plug-in is likely a more robust solution, sometimes modifying the host isn't an option.
    – S0AndS0
    Nov 2, 2019 at 21:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .