- What it is
- A complete copy of your secret key material, held on something separate from the computer that normally uses it.
- How you get one
- You export it from the tool that holds it and write that export onto storage or paper you keep elsewhere.
- Where to keep it
- Somewhere physically apart from the machine, protected by whatever passphrase the export supports, and not in a cloud account.
- How it goes wrong
- It is taken once, never tested, and turns out years later to be truncated, corrupt or locked behind a forgotten passphrase.
- What fails without it
- One dead disk ends the identity permanently, along with anything only that identity could open.
- Time to acquire
- An evening, most of which is spent confirming that the copy actually works.
Nobody can issue you another one
Most things in this inventory can be replaced. A notebook can be rewritten. An address can be copied again. A username is a string you already know. Key material is not like that. It is the only item here with no source outside your own possession, and losing it is not an inconvenience that gets sorted out later. It is final.
Everything that identity signed, everything sent to it, and any claim you might make to being the same person as before, goes with it. That is why this page exists as a separate item rather than a paragraph on your own key.
Separate means physically separate
A second copy in another folder on the same disk is not a backup. Neither is a copy on a drive that stays plugged into the same machine, since the common failures are theft, seizure, fire, a dropped laptop, and encryption ransom, and all of those take everything attached at once.
What counts is storage that is normally disconnected, kept somewhere the machine is not. Paper qualifies and has the advantage of surviving formats and file systems. The awkwardness of retrieving it is a feature rather than a cost, because material you can reach in seconds is material anything running on your machine can reach too.
A copy you have not tested is a guess
The failure that actually happens is not losing the backup. It is discovering, at the point of using it, that the export was incomplete, that the file got truncated in transfer, that the media has degraded, or that the passphrase protecting it was one you set in a hurry and stopped thinking about the same day.
So the acquisition is not finished when the copy exists. It is finished when you have restored from it somewhere and watched it work. Until then you have an object you believe in, which is a different thing from a backup.
| Failure | What it looks like | What prevents it |
|---|---|---|
| Truncated export | The file is there and ends in the wrong place | Restoring from it once, on purpose, after taking it |
| Same-machine copy | A backup folder on the disk that just died | Storage that stays disconnected and elsewhere |
| Forgotten passphrase | The copy is intact and will not open | Recording the passphrase separately from the copy |
| Media rot | Unreadable after years in a drawer | A second medium, and paper for the long term |
The passphrase is part of the item
An encrypted export and the passphrase that opens it are one item split in two, and holding half of it is holding none of it. Both halves need somewhere to live, and the somewhere cannot be the same place, or the encryption has stopped doing anything. This is the same reasoning as the passphrase page and the same reasoning behind recovery material.
People solve this badly by choosing a passphrase they are sure to remember, which usually means one they use elsewhere. That converts a storage problem into a reuse problem.
Why this one keeps
The material does not expire. A key copied today is the same key in five years, which is why this sits on the keeping side of the inventory rather than the perishable side. What ages is the medium and your own memory of where you put it. A yearly look at the copy, confirming it is where you left it and still opens, is the whole of the upkeep.
When an identity is genuinely finished with, the copy becomes a liability rather than an asset, and retiring an item covers ending it cleanly. The decision about when that point has arrived belongs on the exit plan.
Questions that come up
Is paper really sensible for this?
For long term storage it is the most durable option available, because it survives file format changes, drive failures and operating system upgrades, none of which it has any relationship with. It is awkward to produce and awkward to restore from, and both of those are acceptable for something you hope to touch once a year at most. Keeping a digital copy as well is reasonable.
How often should I check it?
Rarely, on a schedule you actually keep rather than an ambitious one you abandon. Once a year is enough to catch media problems and forgotten passphrases while there is still a working original to make a fresh copy from. Checking is the part people skip, and an unchecked backup is where the surprises live.
What if the machine is fine and I just want a second one?
Same item, same reasoning. A copy taken while everything works is exactly the copy you want, because you can test it against a functioning original and confirm the two match. Backups taken in an emergency are taken from whatever survived, which may already be the damaged version.