## Overview

This guide walks through installing and running Superbacked on macOS. Superbacked is distributed as disk image (`.dmg`) which is cryptographically signed and notarized by Apple.

> Heads-up: for high-stakes secrets, use [Superbacked OS](https://superbacked.com/superbacked-os) — a hardened operating system that runs offline and persists nothing to disk.

## Setup guide

### Step 1: download Superbacked

Download latest release (`.dmg`) from [superbacked.com/download](https://superbacked.com/download) and optionally [verify integrity of release](../how-to-verify-integrity-of-release/README.md).

### Step 2: install Superbacked

Double-click downloaded `.dmg` file and drag “Superbacked” to “Applications” folder.

### Step 3 (optional): make `superbacked` command available in terminal

Add a persistent alias to the app binary by running following commands once — `superbacked --help` then lists commands.

```console
$ echo 'alias superbacked="/Applications/Superbacked.app/Contents/MacOS/Superbacked"' >> "$HOME/.zshrc"

$ source "$HOME/.zshrc"
```

## Usage guide

> Heads-up: macOS may display a security prompt. Click “Open” to proceed — release is cryptographically signed and notarized by Apple.

Open Superbacked from “Applications” folder or run `superbacked` in terminal to use the command-line interface (see [step 3](#step-3-optional-make-superbacked-command-available-in-terminal)).


## Overview

This guide walks through installing and running Superbacked on Ubuntu Desktop. Superbacked is distributed as Debian package which installs dependencies automatically, including the AppArmor profile Ubuntu Desktop 23.10+ requires to run Chromium’s sandbox.

> Heads-up: for high-stakes secrets, use [Superbacked OS](https://superbacked.com/superbacked-os) — a hardened operating system that runs offline and persists nothing to disk.

## Setup guide

### Step 1: download Superbacked

Download latest release (`.deb`) from [superbacked.com/download](https://superbacked.com/download) and optionally [verify integrity of release](../how-to-verify-integrity-of-release/README.md).

### Step 2: install Superbacked

> Heads-up: on ARM computers (such as Raspberry Pis), replace `x64` with `arm64` in the following command. When reading this guide on GitHub, also replace the version placeholder with the [latest release](https://github.com/superbacked/superbacked/releases/latest) version.

Run following command.

```console
$ sudo apt install --yes ~/Downloads/superbacked-x64-${latestRelease}.deb
```

## Usage guide

> Heads-up: YubiKey connected while installing Superbacked must be unplugged and plugged back in before use.

Open Superbacked from the application grid or run `superbacked` in terminal to use the command-line interface.


## Overview

This guide walks through downloading and running Superbacked on Tails. Superbacked is distributed as AppImage binary — a portable format that runs on Tails with no installation.

> Heads-up: Tails has limited printing support. Printing blocks may not work as expected depending on printer configuration. Consider saving blocks and printing from another computer or, preferably, use [Superbacked OS](https://superbacked.com/superbacked-os) which has better printer support.

> Heads-up: for high-stakes secrets, use [Superbacked OS](https://superbacked.com/superbacked-os) — a hardened operating system that runs offline and persists nothing to disk.

## Setup guide

### Step 1: download Superbacked

Download latest release (`.AppImage`) from [superbacked.com/download](https://superbacked.com/download) and optionally [verify integrity of release](../how-to-verify-integrity-of-release/README.md).

### Step 2 (optional): grant access to YubiKey

> Heads-up: this step is only required when using YubiKey features and requires administration password to be set using welcome screen when starting Tails.

Run following command — a YubiKey already connected must then be unplugged and plugged back in.

```console
$ sudo tee /etc/udev/rules.d/70-superbacked-yubikey.rules << 'EOF'
KERNEL=="hidraw*", SUBSYSTEM=="hidraw", ATTRS{idVendor}=="1050", TAG+="uaccess"
EOF
```

### Step 3 (optional): make `superbacked` command available in terminal

> Heads-up: when reading this guide on GitHub, replace the version placeholder in the following command with the [latest release](https://github.com/superbacked/superbacked/releases/latest) version.

> Heads-up: Tails does not ship wl-clipboard, so commands that copy to the clipboard need `--print` (or install wl-clipboard using `sudo apt install wl-clipboard`).

Install the AppImage as `superbacked` in `~/.local/bin` (created if missing) and reload the profile so `~/.local/bin` is on the path by running following commands — `superbacked --help` then lists commands.

```console
$ install -D -m 755 "$HOME/Downloads/superbacked-x64-${latestRelease}.AppImage" "$HOME/.local/bin/superbacked"

$ source "$HOME/.profile"
```

## Usage guide

Right-click `.AppImage` file and select “Run” or run `superbacked` in terminal to use the command-line interface (see [step 3](#step-3-optional-make-superbacked-command-available-in-terminal)).


## Overview

This guide walks through flashing Superbacked OS to a USB flash drive and booting a computer from it. Superbacked OS runs entirely from memory — the USB flash drive can be unplugged as soon as the login screen appears and nothing from the session survives shutdown. Networking is disabled by default (air-gapped mode). Hardened browser mode, chosen at boot, gives network access to a hardened Firefox — and to nothing else — for tasks such as backing up TOTP secrets.

## Requirements

- Computer compatible with Ubuntu 24.04.4 LTS
- USB flash drive (used to run Superbacked OS, 16 GB min, faster is better)
- 4 GB of memory or more (8 GB required to run entirely from memory and unplug USB flash drive)
- [Brother HL-L2460DW](https://www.brother-usa.com/products/hll2460dw) or equivalent USB printer (used to print blocks)
- Plug-and-play or built-in webcam (1080p min)

## Recommendations (optional)

Physically remove internal disks and wireless interfaces (or disable them using BIOS if soldered to motherboard) to rule out data persistence and network connectivity at the hardware level.

Run Superbacked OS from a USB flash drive with signed firmware and write protection, such as [Kanguru FlashTrust™ Secure Firmware USB 3.0 Flash Drive (WP-KFT3-16G)](https://www.kanguru.com/products/kanguru-flashtrust-secure-firmware-usb-3-0-flash-drive).

## Setup guide

### Step 1: install Raspberry Pi Imager

#### macOS or Windows

Go to [raspberrypi.com/software](https://www.raspberrypi.com/software/), download and install Raspberry Pi Imager.

#### Ubuntu Desktop

Run following commands (rpi-imager lives in the universe repository and depends on [Qt](https://www.qt.io/)).

```console
$ sudo add-apt-repository --yes universe

$ sudo apt install --yes rpi-imager
```

### Step 2 (optional): opt out of Raspberry Pi Imager telemetry

Select “App Options”, disable “Enable anonymous statistics ([telemetry](https://github.com/raspberrypi/rpi-imager#opting-out)) collection” and click “Save”.

### Step 3: download Superbacked OS

> Heads-up: when reading this guide on GitHub, replace the version placeholder in the following commands with the [latest release](https://github.com/superbacked/superbacked/releases/latest) version.

Download latest release by running following commands and optionally [verify integrity of release](../how-to-verify-integrity-of-release/README.md).

#### macOS or Ubuntu Desktop

```console
$ cd ~/Downloads

$ part=1; \
  url="https://github.com/superbacked/superbacked/releases/download/v${latestRelease}/superbacked-os-amd64-live-${latestRelease}.img.part"; \
  while curl --fail --head --location --output /dev/null --proto '=https' --retry 3 --silent "${url}${part}"; do \
    curl --fail --location --proto '=https' "${url}${part}" || break; \
    part=$((part + 1)); \
  done > superbacked-os-amd64-live-${latestRelease}.img
```

#### Windows

> Heads-up: this step requires [WSL](https://learn.microsoft.com/en-us/windows/wsl/install) — if not installed yet, run `wsl --install` first.

> Heads-up: replace `Sun Knudsen` with your username.

```console
$ wsl

$ cd /mnt/c/Users/Sun\ Knudsen/Downloads

$ part=1; \
  url="https://github.com/superbacked/superbacked/releases/download/v${latestRelease}/superbacked-os-amd64-live-${latestRelease}.img.part"; \
  while curl --fail --head --location --output /dev/null --proto '=https' --retry 3 --silent "${url}${part}"; do \
    curl --fail --location --proto '=https' "${url}${part}" || break; \
    part=$((part + 1)); \
  done > superbacked-os-amd64-live-${latestRelease}.img
```

### Step 4: copy Superbacked OS to USB flash drive

Open “Raspberry Pi Imager”, click “OS”, then “Use custom”, select `superbacked-os-amd64-live-${latestRelease}.img`, click “Storage”, select USB flash drive, click “NEXT”, then “WRITE” and, finally, click “I UNDERSTAND, ERASE AND WRITE”.

![Raspberry Pi Imager, release version may differ](./assets/raspberry-pi-imager.png)

### Step 5 (optional): enable write protection

If using Kanguru FlashTrust™ Secure Firmware USB 3.0 Flash Drive or equivalent, enable write protection.

## Computer provisioning guide

### Step 1 (optional): remove or disable internal disks and wireless interfaces

![I/O Port Access, BIOS menu may differ](./assets/turn-off-i-o-port-access.png)

### Step 2 (if applicable): enable “Secure Boot” and disable “Boot Order Lock”

![Secure Boot, BIOS menu may differ](./assets/enable-secure-boot.png)

![Boot Order Lock, BIOS menu may differ](./assets/disable-boot-order-lock.png)

### Step 3: boot Superbacked OS

### Step 4: reboot

### Step 5 (if applicable): enable “Boot Order Lock”

![Boot Order Lock, BIOS menu may differ](./assets/enable-boot-order-lock.png)

## Usage guide

### Step 1 (if applicable): unplug Ethernet cable

### Step 2: boot Superbacked OS and select mode

> Heads-up: on computers with less than 8 GB of memory (4 GB min), Superbacked OS runs from the USB flash drive instead, which must then stay plugged in for the whole session (equally amnesic) — a warning is shown after login when that happens. Running from the USB flash drive can also be chosen on purpose by editing a boot entry at the GRUB menu (pressing “e”) and removing `toram`.

Superbacked OS boots into air-gapped mode automatically — networking is disabled. Hardened browser mode, selected at the GRUB menu as “Superbacked OS (hardened browser)”, gives network access to a hardened Firefox — and to nothing else.

Both modes copy Superbacked OS to memory (8 GB required) — the USB flash drive can be unplugged as soon as the login screen appears.

### Step 3: log in

Log in using password “superbacked”.

### Step 4: open Superbacked

Open Superbacked from the dock or run `superbacked` in terminal to use the command-line interface.

If scanning blocks does not work, try a higher quality 1080p webcam such as the [Razer Kiyo X](https://www.razer.com/streaming-cameras/razer-kiyo-x).


## Overview

This guide walks through verifying that Superbacked OS persists nothing to disk by comparing partition checksums to release checksums before and after use.

Each release publishes the checksum of its boot and root partitions — a freshly flashed USB flash drive matches them and, because Superbacked OS writes nothing to disk, still matches them after use.

Superbacked OS runs entirely from memory, so the USB flash drive can be unplugged as soon as the login screen appears — nothing can be written to a drive that is not connected. The comparison below covers what remains: the boot itself and any session during which the drive stays plugged in, by choice or because the computer has too little memory and Superbacked OS runs from the drive instead. To verify a full session, leave the drive plugged in.

## Guide

> Heads-up: replace `2.0.0` with the version of the release flashed to the USB flash drive.

Download `superbacked-os-amd64-live-2.0.0.img.sha256sums` from the [release page](https://github.com/superbacked/superbacked/releases) — it lists the release checksum of each partition.

### macOS

#### Step 1: verify partition checksums match release checksums

> Heads-up: replace `rdisk4` with the disk found using `diskutil list`.

Run following commands.

```console
$ cat superbacked-os-amd64-live-2.0.0.img.sha256sums
Boot partition: 33958f20e63dd15591231ea42901671a4017aadf1e13e6d91a267902aeba93cb
Root partition: 7eb23703c303acfe6fd956358a1ecd4cae23075d3213432fb7fa4022bcb63a32

$ diskutil list
…

/dev/disk4 (external, physical):
   #:                       TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme                        *15.5 GB    disk4
   1:                        EFI NO NAME                 536.9 MB   disk4s1
   2:           Linux Filesystem                         2.6 GB     disk4s2
                    (free space)                         12.3 GB    -

$ sudo diskutil unmountDisk /dev/disk4
Password:
Unmount of all volumes on disk4 was successful

$ sudo shasum --algorithm 256 /dev/rdisk4s1 /dev/rdisk4s2
33958f20e63dd15591231ea42901671a4017aadf1e13e6d91a267902aeba93cb  /dev/rdisk4s1
7eb23703c303acfe6fd956358a1ecd4cae23075d3213432fb7fa4022bcb63a32  /dev/rdisk4s2
```

Verify checksums match release checksums — a mismatch means the download or flash is bad, not that data was persisted.

#### Step 2: verify partition checksums still match release checksums after use

Complete step 1 again after using Superbacked OS — checksums still match release checksums when nothing was persisted.

### Ubuntu Desktop

#### Step 1: verify partition checksums match release checksums

> Heads-up: replace `sdb` with the disk found using `sudo fdisk --list`.

Run following commands.

```console
$ cat superbacked-os-amd64-live-2.0.0.img.sha256sums
Boot partition: 33958f20e63dd15591231ea42901671a4017aadf1e13e6d91a267902aeba93cb
Root partition: 7eb23703c303acfe6fd956358a1ecd4cae23075d3213432fb7fa4022bcb63a32

$ sudo fdisk --list
…
Disk /dev/sdb: 14.44 GiB, 15502147584 bytes, 30277632 sectors
Disk model: FlashTrust
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: gpt
Disk identifier: 3E1A4945-08EE-46F6-94B8-3516ADB718F2

Device       Start     End Sectors  Size Type
/dev/sdb1     2048 1050623 1048576  512M EFI System
/dev/sdb2  1050624 6195199 5144576  2.5G Linux filesystem

$ sudo umount /dev/sdb*
umount: /dev/sdb: not mounted.
umount: /dev/sdb1: not mounted.
umount: /dev/sdb2: not mounted.

$ sudo sha256sum /dev/sdb1 /dev/sdb2
33958f20e63dd15591231ea42901671a4017aadf1e13e6d91a267902aeba93cb  /dev/sdb1
7eb23703c303acfe6fd956358a1ecd4cae23075d3213432fb7fa4022bcb63a32  /dev/sdb2
```

Verify checksums match release checksums — a mismatch means the download or flash is bad, not that data was persisted.

#### Step 2: verify partition checksums still match release checksums after use

Complete step 1 again after using Superbacked OS — checksums still match release checksums when nothing was persisted.


## Overview

This guide walks through provisioning a YubiKey with an HMAC-SHA1 challenge-response secret using the command-line interface — the secret derived passwords, derived Bitcoin wallets and YubiKey-protected blocks and standalone archives rely on. The secret is generated once and can be backed up or provisioned to as many YubiKeys as needed, so a lost or broken YubiKey can be replaced.

> Heads-up: for high-stakes secrets, use [Superbacked OS](https://superbacked.com/superbacked-os) — a hardened operating system that runs offline and persists nothing to disk — especially when provisioning YubiKey hardware, the only moment the secret exists in plaintext on a computer.

## Setup guide

The `superbacked` command is available in terminal on [Ubuntu Desktop](../how-to-install-superbacked-on-ubuntu-desktop/README.md) and [Superbacked OS](../how-to-run-superbacked-os-on-desktop-or-laptop/README.md), and after the optional terminal step of the [macOS](../how-to-install-superbacked-on-macos/README.md) and [Tails](../how-to-run-superbacked-on-tails/README.md) guides.

## Usage guide

### Step 1: provision YubiKey

> Heads-up: on most YubiKeys, slot 1 ships programmed with the factory Yubico OTP credential and overwriting it is permanent — which is why Superbacked defaults to slot 2, leaving the factory credential intact. Use `--slot 1` only if overwriting it is deliberate.

> Heads-up: on macOS, opening the YubiKey may require granting the terminal Input Monitoring permission (System Settings → Privacy & Security → Input Monitoring).

> Heads-up: if the YubiKey’s OTP interface is disabled, the command offers to enable it and waits for the YubiKey to restart. If the slot is already programmed, the command asks before overwriting it — overwriting permanently destroys the current secret.

Superbacked uses HMAC-SHA1 challenge-response, so the YubiKey needs to be provisioned once with a challenge-response secret — the same operation Yubico Authenticator calls “Program a challenge-response credential”. The following command generates a secret, provisions slot 2, verifies the slot answers correctly and displays the secret so it can be backed up (on Superbacked OS, the first confirmation is skipped).

```console
$ superbacked provision-yubikey --generate
Provisioning a YubiKey exposes a long-lived secret to computer.
When provisioning YubiKey hardware, use Superbacked OS.
Do you wish to continue (yes or no)? yes
YubiKey detected
The generated secret is displayed once and cannot be read back from the YubiKey.
Use a blockset or block that is not YubiKey-protected to back up the secret or provision another YubiKey with the same secret — without either, everything relying on this secret is unrecoverable if the YubiKey is lost or broken.
Do you wish to continue (yes or no)? yes
Touch YubiKey…
Slot 2 provisioned for HMAC-SHA1 challenge-response
Secret: 8d66618b105e51cbf0412f8a29368e71d4bb27b5
```

By default, computing a response requires touching the YubiKey — every derivation asks for physical presence.

Use `--no-touch` to provision a slot that answers without touch (weaker).

### Step 2: back up secret

> Heads-up: the secret is displayed only once and cannot be read back from the YubiKey — without a backup of the secret or a second YubiKey provisioned with it, every derived password, derived Bitcoin wallet and YubiKey-protected block or standalone archive is unrecoverable.

Back up the secret in a blockset or block that is not YubiKey-protected — restoring the backup must never depend on the YubiKey it replaces. When restored, Superbacked recognizes it as a YubiKey challenge-response secret and reports whether the connected YubiKey is provisioned with it.

### Step 3 (optional): provision second YubiKey

Provision a second YubiKey with the same secret so either one derives the same passwords and wallets — the secret is prompted twice (hidden) and must match. It can also be piped to the command instead of typed.

```console
$ superbacked provision-yubikey
Provisioning a YubiKey exposes a long-lived secret to computer.
When provisioning YubiKey hardware, use Superbacked OS.
Do you wish to continue (yes or no)? yes
YubiKey detected
Secret (40-character hex):
Confirm secret:
Touch YubiKey…
Slot 2 provisioned for HMAC-SHA1 challenge-response
```


## Overview

This guide walks through deriving Bitcoin wallets from a memorized label (for example `hotwallet`), a master passphrase and a YubiKey using the command-line interface — the same wallet every time, so there is no mnemonic to store, sync or lose. Wallets are standard BIP39 mnemonics, so recovery is Superbacked-independent: any wallet software can restore them.

> Heads-up: deriving a Bitcoin wallet exposes its private keys to the computer running the command (unlike a signing device, which never releases its seed) and a forgotten label, forgotten passphrase or lost YubiKey secret is unrecoverable. **For amounts you are not willing to lose, use a signing device such as a Trezor.**

> Heads-up: a YubiKey provisioned with a challenge-response secret is required — see [how to provision YubiKey using command-line interface](../how-to-provision-yubikey-using-command-line-interface/README.md), which also covers backing up the secret.

> Heads-up: for high-stakes secrets, use [Superbacked OS](https://superbacked.com/superbacked-os) — a hardened operating system that runs offline and persists nothing to disk.

## Setup guide

The `superbacked` command is available in terminal on [Ubuntu Desktop](../how-to-install-superbacked-on-ubuntu-desktop/README.md) and [Superbacked OS](../how-to-run-superbacked-os-on-desktop-or-laptop/README.md), and after the optional terminal step of the [macOS](../how-to-install-superbacked-on-macos/README.md) and [Tails](../how-to-run-superbacked-on-tails/README.md) guides.

## Usage guide

### Derive wallet

> Heads-up: the master passphrase is never verified, so a mistyped passphrase silently derives a different wallet. Use `--confirm-passphrase` when deriving a wallet for the first time — the master passphrase is then prompted twice — and derive the wallet again to confirm the same extended public key before sending bitcoin to it.

> Heads-up: on macOS, opening the YubiKey may require granting the terminal Input Monitoring permission (System Settings → Privacy & Security → Input Monitoring).

By default, the command prints the wallet’s extended public key (`zpub…`) — enough to set up a watch-only wallet — without revealing the mnemonic (the command refuses weak master passphrases, like everywhere else in Superbacked).

```console
$ superbacked derive-bitcoin-wallet
Deriving a Bitcoin wallet exposes its private keys to the computer running the command.
For amounts you are not willing to lose, use a signing device such as a Trezor.
Do you wish to continue (yes or no)? yes
Label: hotwallet
Passphrase:
Touch YubiKey…
Derived using scheme v1, path m/84'/0'/0', 24 words
zpub6rskz9PppDLZKurVF9qhu7bs1TvadsejsGWmsFfQ2aVkKHi3eGiDCQXMEtgHBb1ucSHPMWnbRPoUsGwnAMS81q2ie77dD5sGzSXXpwKbFSo
```

Every derivation states the scheme version, the derivation path and the word count (and Paranoid mode, when enabled) — derivation is stateless, so a different word count (`--words 12`) or mode derives a different wallet and these are part of what must be remembered to re-derive the same one (the derivation path is fixed, stated for cross-verification in wallet software).

Use the root `--paranoid` flag to harden key derivation (10× standard cost, requiring at least 1 GiB of memory) — a wallet derived with it can only be re-derived with it.

Use `--addresses` to also print the first receive addresses — importing the same wallet elsewhere must show the same ones.

```console
$ superbacked derive-bitcoin-wallet hotwallet --addresses 3
…
m/84'/0'/0'/0/0 bc1qmmvmyjcpcqkkw7ssewyd8vw6ud6ctv6rh9m7xq
m/84'/0'/0'/0/1 bc1qcjk90ecfvf6pvm6nfspvzhk20p3v9vawxnfwjw
m/84'/0'/0'/0/2 bc1qv2wjjvr4j6ldkehaph8099dezy033qcshs9k7y
```

### Reveal mnemonic or import into wallet software

> Heads-up: on Linux, copying to the clipboard under Wayland requires wl-clipboard (`sudo apt install wl-clipboard`) — preinstalled on Superbacked OS. On GNOME, a dock icon may blink when the mnemonic is copied or cleared — cosmetic and expected.

Use `--reveal mnemonic` to copy the BIP39 mnemonic to the clipboard (clearing after 10 seconds, keeping it out of terminal scrollback) — importable into any BIP39 wallet (for example [Electrum](https://electrum.org/)). Confirm the wallet software reports the same extended public key and addresses the command printed.

```console
$ superbacked derive-bitcoin-wallet hotwallet --reveal mnemonic
…
Mnemonic copied to clipboard, clearing in 10 seconds…
```

Use `--reveal zprv` to copy the extended private key instead — pasting it into Electrum imports the entire account without exposing the mnemonic.

Use `--print` with `--reveal` to print the secret to stdout instead of copying it to the clipboard.


## Overview

This guide walks through deriving strong passwords from a memorized label (for example `github` or `proton`), a master passphrase and a YubiKey using the command-line interface — the same password every time, so there is no vault to store, sync or lose.

> Heads-up: a YubiKey provisioned with a challenge-response secret is required — see [how to provision YubiKey using command-line interface](../how-to-provision-yubikey-using-command-line-interface/README.md), which also covers backing up the secret.

> Heads-up: for high-stakes secrets, use [Superbacked OS](https://superbacked.com/superbacked-os) — a hardened operating system that runs offline and persists nothing to disk.

## Setup guide

The `superbacked` command is available in terminal on [Ubuntu Desktop](../how-to-install-superbacked-on-ubuntu-desktop/README.md) and [Superbacked OS](../how-to-run-superbacked-os-on-desktop-or-laptop/README.md), and after the optional terminal step of the [macOS](../how-to-install-superbacked-on-macos/README.md) and [Tails](../how-to-run-superbacked-on-tails/README.md) guides.

## Usage guide

> Heads-up: the master passphrase is never verified, so a mistyped passphrase silently derives a different password. Use `--confirm-passphrase` when deriving a password for the first time — the master passphrase is then prompted twice.

> Heads-up: on macOS, opening the YubiKey may require granting the terminal Input Monitoring permission (System Settings → Privacy & Security → Input Monitoring).

> Heads-up: on Linux, copying to the clipboard under Wayland requires wl-clipboard (`sudo apt install wl-clipboard`) — preinstalled on Superbacked OS. On GNOME, a dock icon may blink when the password is copied or cleared — cosmetic and expected.

Derive a password from the master passphrase and a memorized label (the command refuses weak master passphrases, like everywhere else in Superbacked).

```console
$ superbacked derive-password
Label: github
Passphrase:
Touch YubiKey…
Derived using scheme v1
Password copied to clipboard, clearing in 10 seconds…
```

The password is copied to the clipboard by default, keeping it out of terminal scrollback — pressing enter clears the clipboard immediately. Every derivation states the scheme version (and Paranoid mode, when enabled) — derivation is stateless, so these are part of what must be remembered to re-derive the same password.

Use the root `--paranoid` flag to harden key derivation (10× standard cost, requiring at least 1 GiB of memory) — a password derived with it can only be re-derived with it.

Use `--print` to print the password to stdout instead and `--length` to set the password length (default `16`).

To replace a password (for example following a leak), change the label (for example `github2`) — the same label always derives the same password.


## Overview

This guide walks through encrypting files and folders as standalone archives using the command-line interface — portable `.superbacked` files protected using a passphrase and, optionally, a YubiKey. Archives created using the command-line interface are byte-identical to app-created ones, so they can also be restored by drag and drop in the app.

> Heads-up: for high-stakes secrets, use [Superbacked OS](https://superbacked.com/superbacked-os) — a hardened operating system that runs offline and persists nothing to disk.

## Setup guide

The `superbacked` command is available in terminal on [Ubuntu Desktop](../how-to-install-superbacked-on-ubuntu-desktop/README.md) and [Superbacked OS](../how-to-run-superbacked-os-on-desktop-or-laptop/README.md), and after the optional terminal step of the [macOS](../how-to-install-superbacked-on-macos/README.md) and [Tails](../how-to-run-superbacked-on-tails/README.md) guides.

## Usage guide

### Create standalone archive

> Heads-up: a forgotten passphrase — and the standalone archive content it encrypts — is unrecoverable.

Encrypt one or more files and/or folders (the `.superbacked` extension is appended automatically and the command refuses weak passphrases).

```console
$ superbacked create-standalone-archive ~/Documents/passport.pdf ~/Documents/wallet --output backup
Passphrase:
Confirm passphrase:
/Users/sun/backup.superbacked
```

The archive path is printed on success.

Use the root `--paranoid` flag to harden key derivation (10× standard cost, requiring at least 1 GiB of memory) — a paranoid archive can only be restored with `--paranoid` (or the app’s “Enable paranoid mode” setting), and without it reports a wrong passphrase.

Use `--yubikey` to protect the archive with YubiKey (see [how to provision YubiKey using command-line interface](../how-to-provision-yubikey-using-command-line-interface/README.md)) — restoring then requires `--yubikey` (or the app’s “Protected with YubiKey” switch) and a connected YubiKey provisioned with the same challenge-response secret.

Use `--force` to overwrite an existing archive.

### Restore standalone archive

Restore a standalone archive to an existing directory.

```console
$ mkdir restored

$ superbacked restore-standalone-archive backup.superbacked --output restored
Passphrase:
/Users/sun/restored
```

The destination path is printed on success. Standalone archives can also be restored by dragging and dropping them in the app — for archives created with `--yubikey`, enable the “Protected with YubiKey” switch with a YubiKey provisioned with the same challenge-response secret connected.


## Overview

This guide walks through verifying that a downloaded Superbacked release has not been tampered with using SHA256 checksums and PGP signatures.

## Guide

### Step 1: download release’s `SHA256SUMS` and `SHA256SUMS.asc`

Download `SHA256SUMS` and `SHA256SUMS.asc` from the [release page](https://github.com/superbacked/superbacked/releases) to the same folder as the downloaded release.

```console
$ ls
SHA256SUMS
SHA256SUMS.asc
superbacked-arm64-2.0.0.dmg
```

### Step 2 (optional): verify integrity of `SHA256SUMS` using GnuPG

> Heads-up: the integrity of Sun’s PGP public key can be confirmed using the fingerprint published on [sunknudsen.com/contact](https://sunknudsen.com/contact), [GitHub](https://github.com/sunknudsen/pgp-public-key), [Twitter](https://twitter.com/sunknudsen) and [YouTube](https://www.youtube.com/sunknudsen/about).

Import Sun’s PGP public key and verify the signature.

```console
$ curl --location --proto '=https' https://sunknudsen.com/sunknudsen.asc | gpg --import
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   167    0   167    0     0   2088      0 --:--:-- --:--:-- --:--:--  2113
100  1302  100  1302    0     0   5948      0 --:--:-- --:--:-- --:--:--  5948
gpg: key 8C9CA674C47CA060: public key "Sun Knudsen <hello@sunknudsen.com>" imported
gpg: Total number processed: 1
gpg:               imported: 1

$ gpg --verify --with-fingerprint SHA256SUMS.asc
gpg: assuming signed data in 'SHA256SUMS'
gpg: Signature made Wed  4 Nov 09:42:35 2026 EST
gpg:                using EDDSA key 9C7887E1B5FCBCE2DFED0E1C02C43AD072D57783
gpg: Good signature from "Sun Knudsen <hello@sunknudsen.com>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: E786 274B C92B 47C2 3C1C  F44B 8C9C A674 C47C A060
     Subkey fingerprint: 9C78 87E1 B5FC BCE2 DFED  0E1C 02C4 3AD0 72D5 7783
```

Verify the output shows `Good signature from "Sun Knudsen <hello@sunknudsen.com>"` and the primary key fingerprint matches `E786 274B C92B 47C2 3C1C F44B 8C9C A674 C47C A060`.

### Step 3: verify integrity of release

> Heads-up: on Linux, run `sha256sum --check --ignore-missing SHA256SUMS` instead.

Run following command.

```console
$ shasum --algorithm 256 --check --ignore-missing SHA256SUMS
./superbacked-arm64-2.0.0.dmg: OK
```

Verify the output shows `OK` for the downloaded release.


Master Superbacked