generate(1) Sequoia Manual generate(1)

generate - Generates a new key

generate [-u|--userid] [-c|--cipher-suite] [--with-password] [--creation-time] [--expires] [--expires-in] [--can-sign] [--cannot-sign] [--can-authenticate] [--cannot-authenticate] [--can-encrypt] [--cannot-encrypt] [-e|--export] [--rev-cert] [-h|--help]

Generates a new key

Generating a key is the prerequisite to receiving encrypted messages and creating signatures. There are a few parameters to this process, but we provide reasonable defaults for most users.

When generating a key, we also generate a revocation certificate. This can be used in case the key is superseded, lost, or compromised. It is a good idea to keep a copy of this in a safe place.

After generating a key, use "sq key extract-cert" to get the certificate corresponding to the key. The key must be kept secure, while the certificate should be handed out to correspondents, e.g. by uploading it to a keyserver.

Adds a userid to the key
Selects the cryptographic algorithms for the key
Protects the key with a password
Sets the key's creation time to TIME. TIME is interpreted as an ISO 8601 timestamp. To set the creation time to June 9, 2011 at midnight UTC, you can do:

$ sq key generate --creation-time 20110609 --export noam.pgp

To include a time, add a T, the time and optionally the timezone (the default timezone is UTC):

$ sq key generate --creation-time 20110609T1938+0200 --export noam.pgp

Makes the key expire at TIME (as ISO 8601). Use "never" to create keys that do not expire.
Makes the key expire after DURATION. Either "N[ymwds]", for N years, months, weeks, days, seconds, or "never".
Adds a signing-capable subkey (default)
Adds no signing-capable subkey
Adds an authentication-capable subkey (default)
Adds no authentication-capable subkey
Adds an encryption-capable subkey. Encryption-capable subkeys can be marked as suitable for transport encryption, storage encryption, or both. [default: universal]
Adds no encryption-capable subkey
Writes the key to OUTFILE
Writes the revocation certificate to FILE. mandatory if OUTFILE is "-". [default: <OUTFILE>.rev]
Print help information


First, this generates a key


sq key generate --userid "<juliet@example.org>" --export juliet.key.pgp


Then, this extracts the certificate for distribution


sq key extract-cert --output juliet.cert.pgp juliet.key.pgp


Generates a key protecting it with a password


sq key generate --userid "<juliet@example.org>" --with-password


Generates a key with multiple userids


sq key generate --userid "<juliet@example.org>" --userid "Juliet Capulet"

For the full documentation see https://docs.sequoia-pgp.org/sq/.

sq(1) sq-armor(1) sq-autocrypt(1) sq-certify(1) sq-dearmor(1) sq-decrypt(1) sq-encrypt(1) sq-inspect(1) sq-key(1) sq-key-adopt(1) sq-key-attest-certifications(1) sq-key-extract-cert(1) sq-key-password(1) sq-key-userid(1) sq-keyring(1) sq-keyserver(1) sq-packet(1) sq-revoke(1) sq-sign(1) sq-verify(1) sq-wkd(1)

July 2022 sq 0.26.0