Tools
pastepile_memory_key
Back up, verify and restore the key that opens your encrypted memories. Pastepile does not have it and cannot reissue it.
3 min read · Updated
An encrypted memory is sealed with a key that lives in a file on the machine that saved it. Pastepile has never had a copy, cannot reissue it, and cannot help you recover a memory without it. That is the guarantee working as intended, and it is also a single point of failure on one disk. This tool is how that stops being true.
Parameters
| Parameter | Type | Description | |
|---|---|---|---|
action | enum | required | status, backup, verify, or restore. See below. |
path | string | optional | The file to write to or read from. Required for backup, verify and restore. The assistant should ask where rather than choosing, and should avoid a location that syncs to a service you did not name. |
replace | boolean | optional | restore only. Without it, restoring refuses to overwrite a DIFFERENT key that is already installed, because doing so makes whatever that key sealed unreadable permanently and silently. |
The four actions
status says whether a key exists on this machine, where it is, and its file permissions. It reports no key material, not even a prefix.
backup copies the key to a path you choose. It refuses to overwrite an existing file, because a backup command that silently replaces one can destroy the previous key on a mistyped path, which is the exact loss it exists to prevent.
verify reads a backup and reports whether it matches the key on this machine. This is the step that turns "you have a backup" into "your backup works", and it is the one most worth doing twice. It installs nothing and prints neither value. A backup that holds a DIFFERENT key is reported as exactly that rather than as a failure: both keys may be real, and the older one may still be the only thing that opens older memories.
restore installs a key from a file, which is what you run on a second machine. Restoring the key that is already installed is a no-op rather than an error, because running a recovery step twice should not fail.
Moving to a second machine
Back up on the machine that has the key, verify the backup there, move the file yourself by whatever means you would use for a password, then restore on the new machine. Verify again afterwards if you want the round trip proven rather than assumed.
Example
Back up my memory key so I can read these on the laptop too.
{
"name": "pastepile_memory_key",
"arguments": { "action": "backup", "path": "/Users/you/keys/pastepile-memory.key" }
}{
"backed_up": true,
"path": "/Users/you/keys/pastepile-memory.key",
"warning": "This file IS the key. Anyone who has it can read every memory it sealed, and Pastepile has no copy to revoke or replace. Store it the way you would store a password, not the way you would store a document.",
"next": "Check it with action \"verify\" and the same path, then move it somewhere that is not this disk. A backup on the disk you are protecting against is not a backup."
}