Allowloopbackpinentry

Allowloopbackpinentry refers to a configuration option used by GnuPG’s gpg-agent to permit the pinentry interface to be used in loopback mode. When enabled, applications can provide a passphrase programmatically through a loopback channel rather than requiring an interactive pinentry window. This capability is commonly needed for automated workflows, scripts, or integrations that sign or decrypt data without a human present at a terminal.

The option is configured in the gpg-agent configuration file, typically located at ~/.gnupg/gpg-agent.conf. To enable loopback pinentry, add a line containing allow-loopback-pinentry. After saving the file, reload the gpg-agent process (for example, with gpgconf --reload gpg-agent or by restarting the agent). Once enabled, you can use pinentry-mode loopback in GnuPG commands to allow passphrase input to come from the program rather than a graphical or curses-based pinentry dialog.

In practice, loopback pinentry is used together with the --pinentry-mode loopback option and a method to supply the passphrase, such as --passphrase-fd 0 to accept input from standard input. A typical workflow involves your script providing the passphrase securely to the GnuPG process, which then performs the requested operation (signing, decrypting, etc.) without opening an interactive prompt.

Security considerations are important: enabling allow-loopback-pinentry reduces the isolation between the passphrase and the system, so it should be restricted to trusted environments and protected scripts. Use strong access controls and minimize exposure of the passphrase, especially on multi-user or unattended systems. For more details, consult the GnuPG manual sections on pinentry-mode and gpg-agent.conf.