# How to correctly (good practice) generate gpg keys in batch mode (unattended) WITH a passphrase

I'm writing a web interface in PHP to generate keys. I'm familiar with gpg's command line options, particularly --batch. I'm also familiar with PHP's GnuPG API.

I can't find a way to safely pass the user's password from the web interface to the gpg command line because gpg uses a pinentry program? PHP's GnuPG functions don't include an API to generate keys.

What other way is there to generate keys, unattended, other than creating a batch file with the passphrase in that file like so:

Key-Type: default
Subkey-Type: default
Name-Real: Bob
Name-Email: bob@gmail.com
Expire-Date: 2021-12-25
Passphrase: mysecretpassphrase
%commit


Note: putting the passphrase on the command line with --passphrase is not wise.

Thanks!

\$ man gpg says around line 1944: