---
name: "tarsnap-keymgmt"
section: "1"
platform: "linux"
package: "tarsnap"
version: "1.0.41-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/tarsnap-keymgmt"
---

# tarsnap-keymgmt(1)

generate subsets of tarsnap(1) key files

## NAME

**tarsnap-keymgmt** – generate subsets of [tarsnap(1)](/tarsnap/1.md) key files

## SYNOPSIS

**tarsnap-keymgmt** **--outkeyfile** *new-key-file* \[**-r**\] \[**-w**\] \[**-d**\] \[**--nuke**\] \[**--passphrased**\] \[**--passphrase-mem** *maxmem*\] \[**--passphrase-time** *maxtime*\] *key-file* *...*

**tarsnap-keymgmt** **--print-key-id** *key-file*

**tarsnap-keymgmt** **--print-key-permissions** *key-file*

**tarsnap-keymgmt** **--version**

## DESCRIPTION

**tarsnap-keymgmt** reads the provided key files and writes a new key file (specified by **--outkeyfile** *new-key-file*) containing only the keys required for the operations specified via the **-r** (list and extract archives), **-w** (write archives), **-d** (delete archives), and **--nuke** flags. Note that **-d** implies **-r** since it is impossible to delete an individual archive without being able to read it; while a key file generated with **--nuke** can be used to delete all the archives stored, but not individual archives.

The following list shows which permissions are required for various [tarsnap(1)](/tarsnap/1.md) *command* *modes*.

- *--recover*

  requires either (1) **-d** (archive deleting), (2) **-w** (archive creating), or (3) **--nuke** keys.

- *--fsck*

  requires either (1) both **-w** (archive writing) and **-r** (archive reading) keys, or (2) **-d** (archive deleting) keys.

- *--fsck-prune*

  requires **-d** (archive deleting) keys, since it needs to be able to delete corrupted archives.

If the **--passphrased** option is specified, the user will be prompted to enter a passphrase (twice) to be used to encrypt the key file.

If the **--passphrase-mem** *maxmem* option is specified, a maximum of *maxmem* bytes of RAM will be used in the scrypt key derivation function to encrypt the key file; it may be necessary to set this option if a key file is being created on a system with far more RAM than the system on which the key file will be used.

If the **--passphrase-time** *maxtime* option is specified, a maximum of approximately *maxtime* seconds will be used in the scrypt key derivation function to encrypt the key file.

Note that if none of the **-w**, **-r**, **-d**, or **--nuke** options are specified, a key file will be produced which does not contain any keys. This is probably not very useful.

The **--print-key-id** *key-file* option displays the 64-bit integer corresponding to the key's machine number. This may be useful for scripts or GUIs which manage a user's Tarsnap account, but is not likely to be helpful for command-line use.

The **--print-key-permissions** *key-file* option displays the permissions which the key possesses.

The **--version** option prints the version number of **tarsnap-keymgmt**, then exits.