NITROCLI(1) General Commands Manual NITROCLI(1) (NAME) nitrocli - Nitrokey (SYNOPSIS) nitrocli command [arguments] (DESCRIPTION) nitrocli Nitrokey . Nitrokey Pro Nitrokey Storage Librem Key . (OTP) (password safe) . (Device selection) nitrocli Nitrokey . --model --serial-number --usb-path . Nitrokey Nitrokey nitrocli . list USB ( ) . (OPTIONS) -m, --model librem|pro|storage << >> (Device selection) . --serial-number serial-number << >> (Device selection) . serial-number (hex) 0x . . Nitrokey Storage USB (USB device descriptor) . --usb-path usb-path USB << >> (Device selection) . --no-cache nitrocli gpg-agent(1) (cache) . . . pin clear . -v, --verbose (logging) . (stderr) . . . . . -V, --version nitrocli . (COMMANDS) (General) nitrocli list [-n|--no-connect] Nitrokey . USB Nitrokey . Nitrokey Storage nitrocli . Nitrokey Storage --no-connect . nitrocli status Nitrokey (firmware) PIN. Nitrokey Storage SD SD (volumes) . nitrocli lock Nitrokey. ( << >> (Password safe) ). Nitrokey Storage ( << >> (Storage) ). nitrocli reset [--only-aes-key] Nitrokey . OpenPGP AES . PIN 123456 PIN (admin) 12345678 . --only-aes-key AES . AES . PIN . PIN . (Storage) Nitrokey Storage . (unencrypted) (encrypted) (block devices) . (hidden) (overlay) . ( ) . nitrocli unencrypted set mode - . mode : read-write read-only . PIN . 0.51 . . nitrocli encrypted open Nitrokey Storage. PIN pinentry(1) gpg-agent(1) . nitrocli encrypted close Nitrokey Storage. nitrocli hidden create slot start end . slot (slot) . start end . . PIN gpg-agent(1) . status SD . nitrocli hidden open . . . . nitrocli hidden close . nitrocli fill [-a|--attach] SD (overwrite) . SD 16 (GiB) . nitrocli . PIN . PIN (cache) . --attach . ..SS Nitrokey Pro Nitrokey Storage Librem Key HOTP RFC 4226 TOTP RFC 6238 . - - (slots) . Nitrokey HOTP TOTP . . TOTP HOTP . Nitrokey . nitrocli otp get slot [-a|--algorithm algorithm] [-t|--time time] . slot . algorithm OTP . hotp HOTP RFC 4226 totp TOTP RFC 6238 (). TOTP Nitrokey . --time time (Unix timestamp) ( 1970-01-01 00:00:00 UTC). PIN ( ). nitrocli otp set slot name secret|- [-a|--algorithm algorithm] [-d|--digits digits] [-c|--counter counter] [-t|--time-window time- window] [-f|--format ascii|base32|hex] . slot . name ( ). secret . secret - . --format . ascii ASCII . base32 base32 RFC 4648 . hex . base32 . algorithm OTP . hotp HOTP RFC 4226 totp TOTP RFC 6238 (). digits . (: ). counter HOTP (: ). time- window TOTP (: ). nitrocli otp clear slot [-a|--algorithm algorithm] . slot . algorithm OTP . hotp HOTP RFC 4226 totp TOTP RFC 6238 (). nitrocli otp status [-a|--all] OTP. --all . Nitrokey : Num Lock Caps Lock Scroll Lock HOTP OTP PIN . nitrocli config get Nitrokey. nitrocli config set [[-n|--num-lock slot] | [-N|--no-num-lock]] [[-c|--caps-lock slot] | [-C|--no-caps-lock]] [[-s|--scroll-lock slot] | [-S|--no-scroll-lock]] [[-o|--otp-pin] | [-O|--no-otp-pin]] Nitrokey. PIN (admin PIN) . --num-lock --caps-lock --scroll-lock . slot HOTP . --no-num-lock --no-caps-lock --no-scroll-lock . . --otp-pin otp get PIN . --no-otp-pin OTP PIN . . Nitrokey Pro Nitrokey Storage Librem Key (PWS) . (login) . PWS (firmware) PIN . PWS . lock . nitrocli pws get slot [-n|--name] [-l|--login] [-p|--password] [-q|--quiet] PWS. slot . ( ) . --name --login --password . . . --quiet PWS . nitrocli pws add [-s|--slot slot] name login password|- PWS . --slot () . --slot PWS . PWS . password - . nitrocli pws update slot [-n|--name name] [-l|--login login] [-p|--password password|-] PWS . slot . --name --login --password . password - . nitrocli pws clear slot PWS. slot . nitrocli pws status [-a|--all] PWS. --all ..SS " (PINs)" Nitrokey PIN : PIN PIN . PIN PIN . PIN otp get ( ) pws . PIN . PIN PIN PIN . . PIN pin unblock PIN . PIN reset gpg(1) . status . nitrocli pin clear PIN . PIN clear PIN . nitrocli pin set type PIN. type PIN : admin PIN user PIN . PIN . ( status .) nitrocli pin unblock PIN . PIN . PIN . unblock PIN gpg(1) ( --change-pin) . (Extensions) nitrocli . <> PATH . ( <> <> ). . (CONFIG FILE) nitrocli ${XDG_CONFIG_HOME}/nitrocli/config.toml ( XDG_CONFIG_HOME ${HOME}/nitrocli/config.toml) . . NITROCLI_KEY key ( ). . : model ( : --model ). serial_numbers ( : --serial-number ). usb_path USB ( : --usb- path ). no_cache true ( : false --no-cache ). verbosity ( : 0 --verbose ). TOML : model = "pro" serial_numbers = ["0xf00baa", "deadbeef"] usb_path = "0001:0006:02" no_cache = false verbosity = 0 (ENVIRONMENT) <> . (Configuration) . . : NITROCLI_MODEL ( : --model ). NITROCLI_SERIAL_NUMBERS ( : --serial- number ). NITROCLI_USB_PATH USB ( : --usb- path ). NITROCLI_NO_CACHE true ( : false --no-cache ). NITROCLI_VERBOSITY ( : 0 --verbose ). PIN (Password & PIN entry) PIN pinentry(1) . : NITROCLI_ADMIN_PIN PIN . NITROCLI_USER_PIN PIN . NITROCLI_NEW_ADMIN_PIN PIN . pin set admin . NITROCLI_NEW_USER_PIN PIN . pin set user . NITROCLI_PASSWORD ( hidden open)..SH " (EXTENSIONS)" nitrocli "nitrocli-" PATH . . nitrocli . : NITROCLI_BINARY nitrocli . nitrocli . NITROCLI_RESOLVED_USB_PATH USB nitrocli --model --serial- number --usb-path . Nitrokey . . "NITROCLI_" . . "NITROCLI_EXT_" . ( ) . . << XDG>> (XDG Base Directory Specification) . : ${XDG_CONFIG_HOME}/extension/ extension "nitrocli-" . TOML . config.toml . ${XDG_DATA_HOME}/extension/ () ${XDG_CACHE_HOME}/extension/ . (FILES) ${XDG_CONFIG_HOME}/nitrocli/config.toml ${HOME}/nitrocli/config.toml Config file . (EXAMPLES) (Storage) ( ) (): $ nitrocli hidden create 0 50 100 (One-time passwords) (hexadecimal): $ nitrocli otp set 0 test-rfc4226 3132333435363738393031323334353637383930 --format hex --algorithm hotp $ nitrocli otp set 1 test-foobar 666F6F626172 --format hex --algorithm hotp $ nitrocli otp set 0 test-rfc6238 3132333435363738393031323334353637383930 --format hex --algorithm totp --digits 8 ASCII: $ nitrocli otp set 0 test-rfc4226 12345678901234567890 --format ascii --algorithm hotp $ nitrocli otp set 1 test-foobar foobar --format ascii --algorithm hotp $ nitrocli otp set 0 test-rfc6238 12345678901234567890 --format ascii --algorithm totp --digits 8 (base32): $ nitrocli otp set 0 test-rfc4226 gezdgnbvgy3tqojqgezdgnbvgy3tqojq --algorithm hotp $ nitrocli otp set 1 test-foobar mzxw6ytboi====== --algorithm hotp $ nitrocli otp set 0 test-rfc6238 gezdgnbvgy3tqojqgezdgnbvgy3tqojq --algorithm totp --digits 8 : $ nitrocli otp get 0 --algorithm hotp 755224 $ nitrocli otp get 0 --algorithm totp --time 1234567890 89005924 : $ nitrocli otp clear 0 --algorithm hotp (Configuration) : $ nitrocli config get Config: numlock binding: not set capslock binding: not set scrollock binding: not set require user PIN for OTP: true : $ nitrocli config set --otp-pin (Password safe) PWS: $ nitrocli pws add example.org john.doe passw0rd Added PWS slot 0 : $ nitrocli pws get 0 name: example.org login: john.doe password: passw0rd ( xclip(1)): $ nitrocli pws get 0 --password --quiet | xclip -in PWS: $ nitrocli pws status slot name 0 example.org 2021-04-24 NITROCLI(1)