.TH VAULT-GET 1 "October 2026" "vault" "User Commands"
.SH NAME
vault-get \- decrypt a stored file
.SH SYNOPSIS
.B vault get
.RB [ \-r ]
.RB [ \-o
.IR OUTPUT ]
.RB [ \-\-key
.IR PATH ]
.RB [ \-\-vault
.IR DIR ]
.I NAME
.SH DESCRIPTION
Decrypts \fINAME\fR. Nothing appears at the output path until every object has
authenticated, padding and end of file included; until then the output is a
private temporary file in the same directory, removed on failure. The stored
mode and modification time are restored. It never replaces anything already
at the output path, including a symbolic link (even a dangling one) or a
file created while it runs. Takes a shared lock.
.PP
With \fB\-r\fR, \fINAME\fR is a folder, and every file under it is
decrypted into the output directory, keeping the folder structure. Each file
is checked as above; a clash stops the run, leaving the files already
written. Directories are created as needed, mode 0700; a symbolic link (or
anything but a directory) where a directory belongs inside the output
directory stops the run rather than being followed.
.SH OPTIONS
.TP
.BI \-o " OUTPUT"
Output path, or with \fB\-r\fR output directory. Default: the base name of
\fINAME\fR in the current directory.
.TP
.B \-r
Decrypt a folder and everything under it.
.PP
See also \fB\-\-key\fR and \fB\-\-vault\fR in
.BR vault (1).
.SH ENVIRONMENT
.TP
.B VAULT_PASSPHRASE
Passphrase, instead of prompting on the terminal.
.SH SEE ALSO
.BR vault (1),
.BR vault\-list (1)
.SH AUTHOR
Andy Dixon <vault@dixon.cx>, https://www.dixon.cx