+++
title = "Create a store"
date = 2026-11-05T00:00:00Z
description = "How to create a password store from zero on a computer: make an OpenPGP key, initialize pass, add a private git remote and export the key."
weight = 30
draft = false
+++

If you already have a store in a git repository, skip to
[Connect the app]({{< relref "/hardenedpass/getting-started/connect" >}}).

HardenedPass cannot generate OpenPGP keys, so the key has to be made elsewhere. The most
comfortable way is a computer with [GnuPG](https://www.gnupg.org/),
[pass](https://www.passwordstore.org/) and [git](https://git-scm.com/) installed. Most Linux
distributions package all three.

No computer? [Termux](https://termux.dev/) gives you the same tools on the phone, and the
commands below work there too. The
[phone only route]({{< relref "/articles/your-own-password-store-part-2#the-phone-only-route" >}})
explains what changes. Your key then lives only on the phone, so make sure you copy it
somewhere safe.

## Make a key pair

```bash
gpg --full-generate-key
```

Accept the default key type, enter your name and an address, and choose a strong
passphrase. You will type it often, so pick one you can remember.

## Create the store

Use the address you gave the key:

```bash
pass init you@example.org
pass git init
```

The first command creates the store in `~/.password-store` and writes `.gpg-id`. The
second turns it into a git repository.

Add a first entry so that you have something to test with. `-m` lets you type several
lines; finish with Ctrl+D:

```bash
pass insert -m example.org
```

```
hunter2
username: alice
```

## Add a remote

Create an **empty, private** repository on a git server you can reach over SSH or
HTTPS. A hosting service works, and so does a server of your own:
[this article]({{< relref "/articles/your-own-password-store-part-2" >}}) compares the
options. Then connect the store to it and send it there:

```bash
pass git remote add origin git@git.example.org:store.git
pass git push -u origin HEAD
```

## Export the private key

The phone needs a copy of the private key:

```bash
gpg --armor --export-secret-keys you@example.org > private-key.asc
```

{{< callout type="warning" title="Handle this file with care" >}}
Move `private-key.asc` to the phone over USB, not through email or a cloud drive.
Delete every copy from the phone's storage and from the computer once the app has
imported it. The app keeps its own.
{{< /callout >}}

Also keep a backup of the key offline, for example on an encrypted USB stick. See
[Concepts]({{< relref "/hardenedpass/getting-started/concepts" >}}) for why.