1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
|
+++
title = "Create a store"
date = 2026-11-05T00:00:00Z
description = "How to create a password store from zero on a computer: make an OpenPGP key, initialize pass, add a private git remote and export the key."
weight = 30
draft = false
+++
If you already have a store in a git repository, skip to
[Connect the app]({{< relref "/hardenedpass/getting-started/connect" >}}).
HardenedPass cannot generate OpenPGP keys, so the key has to be made elsewhere. The most
comfortable way is a computer with [GnuPG](https://www.gnupg.org/),
[pass](https://www.passwordstore.org/) and [git](https://git-scm.com/) installed. Most Linux
distributions package all three.
No computer? [Termux](https://termux.dev/) gives you the same tools on the phone, and the
commands below work there too. The
[phone only route]({{< relref "/articles/your-own-password-store-part-2#the-phone-only-route" >}})
explains what changes. Your key then lives only on the phone, so make sure you copy it
somewhere safe.
## Make a key pair
```bash
gpg --full-generate-key
```
Accept the default key type, enter your name and an address, and choose a strong
passphrase. You will type it often, so pick one you can remember.
## Create the store
Use the address you gave the key:
```bash
pass init you@example.org
pass git init
```
The first command creates the store in `~/.password-store` and writes `.gpg-id`. The
second turns it into a git repository.
Add a first entry so that you have something to test with. `-m` lets you type several
lines; finish with Ctrl+D:
```bash
pass insert -m example.org
```
```
hunter2
username: alice
```
## Add a remote
Create an **empty, private** repository on a git server you can reach over SSH or
HTTPS. A hosting service works, and so does a server of your own:
[this article]({{< relref "/articles/your-own-password-store-part-2" >}}) compares the
options. Then connect the store to it and send it there:
```bash
pass git remote add origin git@git.example.org:store.git
pass git push -u origin HEAD
```
## Export the private key
The phone needs a copy of the private key:
```bash
gpg --armor --export-secret-keys you@example.org > private-key.asc
```
{{< callout type="warning" title="Handle this file with care" >}}
Move `private-key.asc` to the phone over USB, not through email or a cloud drive.
Delete every copy from the phone's storage and from the computer once the app has
imported it. The app keeps its own.
{{< /callout >}}
Also keep a backup of the key offline, for example on an encrypted USB stick. See
[Concepts]({{< relref "/hardenedpass/getting-started/concepts" >}}) for why.
|
