How to encrypt files using command-line interface

Overview

This guide walks through encrypting files and folders as standalone archives using the command-line interface — portable .superbacked files protected using a passphrase and, optionally, a YubiKey. Archives created using the command-line interface are byte-identical to app-created ones, so they can also be restored by drag and drop in the app.

Heads-up: for high-stakes secrets, use Superbacked OS — a hardened operating system that runs offline and persists nothing to disk.

Setup guide

The superbacked command is available in terminal on Ubuntu Desktop and Superbacked OS, and after the optional terminal step of the macOS and Tails guides.

Usage guide

Create standalone archive

Heads-up: a forgotten passphrase — and the standalone archive content it encrypts — is unrecoverable.

Encrypt one or more files and/or folders (the .superbacked extension is appended automatically and the command refuses weak passphrases).

$ superbacked create-standalone-archive ~/Documents/passport.pdf ~/Documents/wallet --output backup
Passphrase:
Confirm passphrase:
/Users/sun/backup.superbacked
Expand code

The archive path is printed on success.

Use the root --paranoid flag to harden key derivation (10× standard cost, requiring at least 1 GiB of memory) — a paranoid archive can only be restored with --paranoid (or the app’s “Enable paranoid mode” setting), and without it reports a wrong passphrase.

Use --yubikey to protect the archive with YubiKey (see how to provision YubiKey using command-line interface) — restoring then requires --yubikey (or the app’s “Protected with YubiKey” switch) and a connected YubiKey provisioned with the same challenge-response secret.

Use --force to overwrite an existing archive.

Restore standalone archive

Restore a standalone archive to an existing directory.

$ mkdir restored

$ superbacked restore-standalone-archive backup.superbacked --output restored
Passphrase:
/Users/sun/restored
Expand code

The destination path is printed on success. Standalone archives can also be restored by dragging and dropping them in the app — for archives created with --yubikey, enable the “Protected with YubiKey” switch with a YubiKey provisioned with the same challenge-response secret connected.