Axantum Software AB | AxCrypt | Command Line Axantum Software AB | AxCrypt | Command Line

Command Line Usage

This section is for system administrators, programmers and other advanced users.

Legacy AxCrypt[1] 1.x may be called by other programs, or manually, by specifying command-line arguments. The general syntax is:

AxCrypt [-i [.ext] | p | u | x ] | [-l] | [-V n] [-v n] [-b tag] [-f] [-c] [-g] [-n filename] [-m] [-e] [-a | -k "passphrase"] [-K folder | filename] [-O path2exe] [-z | d | o | w | s | q | h | J file(s)] [-t [tag]] | file(s)

Except for -i -p -u -x, the options are interpreted sequentially and may occur multiple times if it makes sense.

The options and their meanings

-i [.ext] Install Set all registry values to default. Set the extension to associate with AxCrypt - default is .axx.
-p Psp test Test for the need to install psapi.dll. Only relevant on NT. If return code is 0, no need. This is an installation helper function only.
-u Uninstall Clear all registry values.
-x eXit End the resident server process, if loaded.
-l License Start the license manager dialog.
-b tag Batch id Define a tag, or batch id, to be used with subsequent pass phrases. These pass phrases will only be used when the same tag is specified in future calls to AxCrypt. The batch id is a decimal non-zero positive 32-bit signed integer. Odd values are reserved for internal use. If no -b option is given, saved pass phrases are 'global'. All tagged pass phrases are saved until cleared with -t.
-f Toggle Fast mode Will modify certain operations to execute fast, rather than safe and/or secure. There is no guaranteed effect. Initially off.
-c Toggle Copy-only flag Causes subsequent -d and -z to retain the originals. May be combined with -f for fast copy without wiping of temporaries. Initially off.
-g Toggle ignore encrypted flag If set, attempted encryption of already encrypted files will do nothing. Initially off.
-n Output Name Defines a file name to be used as output instead of default for the next -z or -d.
-m Toggle recurse flag If set, causes subsequent wild card file names to search into sub-directories. Initially off.
-e Encryption pass phrase definition Subsequent -a or -k options on this invocation define the default encryption key instead of one of possibly many decryption keys. The -b option may be used to define pass phrases with limited context.
-a Add pass phrase Prompt for a pass phrase using the AxCrypt standard safe dialogues. -b and -e may be used as modifiers.
-k "pass phrase" Cache pass phrase Cache the given pass phrase, quotes are recommended. The pass phrase is case-sensitive. -b and -e may be used as modifiers. Note that there are restrictions for what passphrases may be used in the AxCrypt dialogs - these are not enforced here! See below for allowed characters in passphrases.
-O "Path2Exe" Set Open Executable Modify a subsequent -o (Open for edit) to use the specified executable instead of the automatic association by extension.
-z encrypt Encrypt (and if useful compress) the given file(s) with either the current default encryption key, or with one that is prompted for. The originals are wiped. -b, -c, -g, -f and -n may be used as modifiers.
-J self-decrypt encrypt Encrypt (and if useful compress) and copy the given file(s) with either the current default encryption key, or with one that is prompted for to a self-decrypting executable archive. -b, -g and -n may be used as modifier. Default is to ignore files that already are self-decrypting.
-K make Key-file Generate and store a Key-file in the given folder, or directly to the given full path-name.
-d Decrypt Decompress and decrypt the given file(s) with either a cached key, or with one that is prompted for. -b, -c, -f and -n may be used as modifiers.
-o Open Open the given file(s) with the appropriate application after temporary decryption and decompression. If they are modified after application exit, they are re-encrypted with the same pass phrase. -b may be used as modifier.
-v n override wipe passes Sets an override of the number of passes for wipe for the remainder of the command line. See -V for more info.
-V n wipe passes Sets the global persistent default number of wipe passes when overwriting, 1-7. Default if not set is 1. The full set of 7 passes will overwrite in the following sequence: random, ones, zeroes, random, zeroes, ones, random. If less are specified only the last n passes are performed. Thus, -V 3 corresponds to the DoD 5220.22-M standard for sanitizing data on fixed hard disks.
-w Wipe Wipe the given files and delete. Show a confirmation warning first.
-s wipe Silent Wipe the given files and delete, but do not ask for confirmation.
-q Query pass phrase cache Return exit code 0 if all files given have pass phrases in the cache already. -b may be used as modifier.
-h Anonymous rename Renames the given file(s) to anonymous names. The original names will be restored on decryption.
-t Clear pass phrase cache Clear the internal pass phrase cache. If -b is given, only pass phrases associated with that tag are affected, otherwise all are removed, tagged and un-tagged alike.

If no options are given but just file(s), they are opened as with -o. Otherwise the most recent -z, -d, -c, -o, -w, -s or -h determines the operation performed on the file.

The first time AxCrypt is started, a server process is initiated which will run until terminated. It's within this process that the pass phrase cache is kept, in a secure manner.

All operations are 'waitable', and will return a non-zero exit code on error.

The 'flag' options are important to specify before the operations they intend to modify, parameters are parsed and executed sequentially as the appear on the command line. Only operating system restrictions on command line lengths limit the number of operations on a single line. If any operation returns an error, the rest of the command line is ignored, and that error is returned as exit code.

Standard wild cards are accepted for all file specifications, except for Open. If the recursion flag is enabled, sub-directories will be searched too.

If you need to do several operations, and keep them together, without affecting the "global" pass phrase cache, use the -b option with an arbitrary tag as described above. Deriving one from the time of day may be appropriate for example. The -b option is valid over multiple calls to the server process, as long as it's not restarted.

Allowed passphrase characters

To minimize the risk of a user entering a passphrase on one system, where it gets difficult to generate the same characters on another system with a different keyboard, certain characters from the ANSI set have been excluded. Also note that currently the passphrase dialog as such does not allow Unicode characters. The following are the legal characters:

<space>
!"#$%&'()*+,-./0123456789:;<=>?@
ABCDEFGHIJKLMNOPQRSTUVWXYZ [\] _abcdefghijklmnopqrstuvwxyz {|}
€ŠŒŽšœžŸ¡ ¢£¤¥§±¼½¾¿ ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏ ÐÑÒÓÔÕÖØÙÚÛÜÝ Þßàáâãäåæçèéêëìíîïð ñòóôõöøùúûüýþÿ

The full key is derived from the passphrase concatenated with the key-file (if any). From this it follows, that you can always create a key-file that contains all the necessary characters that make up a passphrase. In the key-file, there are no restrictions on the contents - it is interpreted as a binary sequence of bytes. If you use this for passphrase data, you must be aware of character encoding issues - a key-file stored in Unicode UTF-16 encoding will probably not work as expected...

Examples

As the command line is made for programmatic access, the usage is not really intuitive so here follows some examples which can be executed as a sequence, which assume that AxCrypt is installed in a typical standard location and that the current directory contains a file named secrets.txt (test this with non-vital data please):

@ECHO ON REM Encrypt secrets.txt with the given passphrase, but do not remember this passphrase
"%ProgramFiles%\Axon Data\AxCrypt\1.6.1\AxCrypt" -b 2 -e -k "A Secret Phrase" -z secrets.txt

REM Decrypt secrets.txt, but prompt for the passphrase
"%ProgramFiles%\Axon Data\AxCrypt\1.6.1\AxCrypt" -b 2 -d secrets-txt.axx

REM Clear the passphrase cache of the default phrase (and all other cached phrases) for batch id '2'
"%ProgramFiles%\Axon Data\AxCrypt\1.6.1\AxCrypt" -b 2 -t

REM Load the passphrase cache with a default encryption phrase using the standard dialog
"%ProgramFiles%\Axon Data\AxCrypt\1.6.1\AxCrypt" -e -a

REM Encrypt secrets.txt with the default encryption phrase just entered
"%ProgramFiles%\Axon Data\AxCrypt\1.6.1\AxCrypt" -z secrets.txt

REM Decrypt secrets-txt.axx
"%ProgramFiles%\Axon Data\AxCrypt\1.6.1\AxCrypt" -d secrets-txt.axx

REM Clear the passphrase cache of the default phrase (and all other cached phrases)
"%ProgramFiles%\Axon Data\AxCrypt\1.6.1\AxCrypt" -t

REM Encrypt to a self-decrypting copy of the original and clear the cache
"%ProgramFiles%\Axon Data\AxCrypt\1.6.1\AxCrypt" -b 2 -e -k "A Secret Phrase" -J secrets.txt

REM Encrypt and copy to a regular encrypted file, but keep the passphrase in the global cache
"%ProgramFiles%\Axon Data\AxCrypt\1.6.1\AxCrypt" -e -k "Another Secret" -c -z secrets.txt

REM Shred the original with an interactive warning
"%ProgramFiles%\Axon Data\AxCrypt\1.6.1\AxCrypt" -w secrets.txt

REM Shred the self-decryping file with no interactive warning
"%ProgramFiles%\Axon Data\AxCrypt\1.6.1\AxCrypt" -s secrets-txt.exe

REM Open the file file with notepad or whatever is used for .txt-files
"%ProgramFiles%\Axon Data\AxCrypt\1.6.1\AxCrypt" secrets-txt.axx

REM Decrypt back to secrets.txt, using the cached phrase
"%ProgramFiles%\Axon Data\AxCrypt\1.6.1\AxCrypt" -d secrets-txt.axx

REM Clear the passphrase cache again
"%ProgramFiles%\Axon Data\AxCrypt\1.6.1\AxCrypt" -t

REM Encrypt all files in the current and sub-directories, and do it fast but just deleting originals etc (i.e. faster)
"%ProgramFiles%\Axon Data\AxCrypt\1.6.1\AxCrypt" -b 2 -e -k "A Third phrase" -m -f -z *.txt

REM Rename all just encrypted files to anonymous names
"%ProgramFiles%\Axon Data\AxCrypt\1.6.1\AxCrypt" -m -h *.axx

REM Decrypt them all again, and clear the cache (batch id 2)
"%ProgramFiles%\Axon Data\AxCrypt\1.6.1\AxCrypt" -b 2 -m -f -d *.axx -t

REM Request that the resident process ends itself, and exits
"%ProgramFiles%\Axon Data\AxCrypt\1.6.1\AxCrypt" -x

Please note that for the passphrase cache to work as implied above, you need to check the appropriate options for keeping the passphrase in the cache when the interactive dialog is displayed. Also please note that you may need to use Alt-Tab to find the passphrase dialog when this is run from a command line window due to Windows design constraints.

[1]AxCrypt is a trademark of AxCrypt AB. Axantum Software AB is no longer actively involved in AxCrypt AB or their products, and AxCrypt AB does not endorse Axantum Software AB or any of the products found here.