Every build of Superbacked includes a command-line interface — encrypt files and folders from scripts, and reach advanced features kept in the terminal on purpose: provisioning YubiKeys and deriving passwords and Bitcoin wallets.
Standalone archives created from terminal are byte-identical to app-created ones — an archive created in a script restores by drag and drop and the other way around.
Run create-standalone-archive with files and folders, choose a strong passphrase and save a single encrypted .superbacked file you can store or share anywhere.
See guide →Run restore-standalone-archive with passphrase to restore files — or drag and drop archive into app.
See guide →Add --yubikey to either command to enable YubiKey protection — restoring then needs provisioned YubiKey as well as passphrase, with “Protected with YubiKey” enabled when restoring in app.
Derive strong passwords from a memorized label, master passphrase and provisioned YubiKey — the same password every time, so there is no vault to store, sync or lose.
Run derive-password with a label such as github — password is copied to clipboard, kept out of terminal scrollback and cleared ten seconds later. Length is configurable, sixteen characters by default.
See guide →The same label always derives the same password — to rotate derived password after a leak, change the label, for example to github2.
Add --paranoid to harden derivation — a password derived with it can only be re-derived with it, so use the flag consistently.
Derive Bitcoin wallets from a memorized label, master passphrase and provisioned YubiKey — the same wallet every time, so there is no mnemonic to store, sync or lose. Wallets use standard BIP39 mnemonics, so any wallet software can restore them.
Run derive-bitcoin-wallet with a label such as hotwallet — by default it prints the extended public key, enough for a watch-only wallet, without revealing the mnemonic. Add --addresses to print the first receive addresses.
See guide →Add --reveal mnemonic to copy the BIP39 mnemonic — importable into any BIP39 wallet — or --reveal zprv to import the account into wallet software such as Electrum.
Add --paranoid to harden derivation — a wallet derived with it can only be re-derived with it, so use the flag consistently.
For high-stakes secrets, use Superbacked OS — a hardened operating system that runs offline and persists nothing to disk.
Copyright (c) Superbacked, Inc.