Local Firefox Password Backup & GPG Vault Manual

This guide documents how to manage a local, passphrase-protected password vault on Linux using asymmetric GPG encryption and the manage-passwords.py utility.

1. Security Architecture

• Private Key Passphrase Protection: Passwords are encrypted against your GPG public key. Decryption requires access to your GPG private key unlocked with your secret passphrase.
• In-Memory Operations: Decryption and re-encryption happen strictly in memory through subprocess pipes. Unencrypted password data is never saved to temporary disk files.
• Atomic File Writes: Re-encrypted updates are written to an atomic temporary file before replacing the target vault to prevent data corruption.
• Default Storage Location: ~/.local/share/password-vault/vault.json.gpg

2. Prerequisites: GPG Keypair

If you do not already have a GPG key: