I have generated keys using GPG, by executing the following command
Now I need to export the key pair to a file;
i.e., private and public keys to
How do I do it?
Stack Exchange network consists of 181 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.Visit Stack Exchange
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.Sign up to join this community
Export Public Key
This command will export an ascii armored version of the public key:
gpg --output public.pgp --armor --export username@email
Export Secret Key
This command will export an ascii armored version of the secret key:
gpg --output private.pgp --armor --export-secret-key username@email
Security Concerns, Backup, and Storage
A PGP public key contains information about one's email address. This is generally acceptable since the public key is used to encrypt email to your address. However, in some cases, this is undesirable.
For most use cases, the secret key need not be exported and should not be distributed. If the purpose is to create a backup key, you should use the backup option:
gpg --output backupkeys.pgp --armor --export-secret-keys --export-options export-backup user@email
This will export all necessary information to restore the secrets keys including the trust database information. Make sure you store any backup secret keys off the computing platform and in a secure physical location.
If this key is important to you, I recommend printing out the key on paper using paperkey. And placing the paper key in a fireproof/waterproof safe.
Public Key Servers
In general, it's not advisable to post personal public keys to key servers. There is no method of removing a key once it's posted and there is no method of ensuring that the key on the server was placed there by the supposed owner of the key.
It is much better to place your public key on a website that you own or control. Some people recommend keybase.io for distribution. However, that method tracks participation in various social and technical communities which may not be desirable for some use cases.
For the technically adept, I personally recommend trying out the webkey domain level key discovery service.
--export-options export-backup, etc). Am I missing something, or did I misunderstand the kind of backup it was making?
gpg --import-options restore --import backupkeys.pgp, but that does not restore secret keys, only the public ones, if backupkeys.pgp was created by
gpg --output backupkeys.pgp --armor --export --export-options export-backup. In that
--armoris not necessary and
export-backupcould be replaced by
gpg -o ~/my-key.asc --export-secret-key name
gpg --import my-key.asc
.ascstands for ASCII, but the output of
gpg --list-secret-keysis binary. Jun 2, 2020 at 15:49
ASCII armoredand the output is enciphered text. You can safely cat it and see for yourself. Also, like most linux files, the file extension is also arbitrary, doesn't technically have to be asc. @WeihangJian Dec 4, 2020 at 14:44
export SOMEKEYID public key to an
gpg --output public.pgp --export SOMEKEYID
When working with secret keys it's generally preferable not to write them to files and, instead, use SSH to copy them directly between machines using only
gpg and a pipe:
gpg --export-secret-key SOMEKEYID | ssh othermachine gpg --import
If you must, however, output your secret key to a file please make sure it's encrypted. Here's how to accomplish that using AES encryption using the Dark Otter approach:
gpg --output public.gpg --export SOMEKEYID && \ gpg --output - --export-secret-key SOMEKEYID |\ cat public.gpg - |\ gpg --armor --output keys.asc --symmetric --cipher-algo AES256
The last approach is ideal if you want to create a physical back-up of your public and private keys to safeguard against a disk failure when no other way exists to regain access to your keys.
Note: If you only have a copy of your private key but not your public key it is possible to recovery your public key by reimporting the private key, trusting it, and then re-exporting.
See Moving GPG Keys Privately for additional considerations.
"GnuPG (aka PGP/GPG)" More information
View all keys:
Export public key:
gpg --export -a --output [path-to-public-key].asc [email-address]
Export secret key:
gpg -a --export-secret-keys > [path-to-secret-key].asc
gpg --full-generate-keyto have a full interface for generating keys