26 Dec 2022 [CT] [guides]

CT-010: Managing passwords, keys, and seeds

This is the 10th report in the Cypherpunk Transmission series.


Passwords, PGP keys, SSH keys, onion service private keys, XMR wallet seeds, addresses, contacts and encrypted messages - it can be a daunting task to securely create, store, and maintain all of that private data.

This guide suggests a solution that is potentially compatible with most threat models.


1. Install KeepassXC

Let’s first install the KeepassXC1 open-source password manager:

sudo apt install keepassxc

2. Create database

Open up KeepassXC and hit CTRL+SHIFT+N to create a new database. The default Decryption Time, Database format and Encryption settings should be fine.

A dice-generated passphrase should be perfect for the master password.

Download any good word list file2345. We will use EFF’s new large word list file eff_large_wordlist.txt (5 dice, 7,776 words):

curl -O https://www.eff.org/files/2016/07/18/eff_large_wordlist.txt

Roll a set of five dice all at once and write the numbers down.

Example roll:
1, 1, 6, 5, 3

Find the corresponding word for the roll with:

grep "11653" eff_large_wordlist.txt

This should output:

11653	animation

We now have the first word of our master password: animation.

Keep rolling until you generate at least 6 words (77 bits of entropy).

Example six-word passphrase:
animation approach corral stoneware blinked hardcore

Use this as your KeepassXC master password and save the encrypted database file (ie. Passwords.kdbx).

Note: you could optionally disguise the file by saving it with a random name and a more common extension (ie. styles.css).

Memorize the passphrase.

Note: if you don’t have a dice set, you can generate random passwords and passphrases in KeepassXC by clicking on the ‘dice’ icon.

3. Workflow

KeepassXC is very easy to use.

Create entries with CTRL+N or use the + icon, generate new passwords with the dice icon, copy and paste passwords from KeepassXC to websites and applications, edit entries with CTRL+E, lock the database with CTRL+L or by pressing the lock icon.

Remember to backup your database files regularly by using the Save Database Backup.. option under the Database menu.


That’s it. Now you can securely create, store and maintain your private data.


Let me know if you find this helpful and, depending on interest, I will do my best to post a new Cypherpunk Transmission report every (other?) Monday.

Questions, edits and suggestions are always appreciated @ /about/.


Credit goes to gnuteardrops from monero.graphics for the amazing xkcd graphic. Work and xkcd Script font licensed under CC BY-NC 3.0.