---
title: Custom field conventions
description: Custom-field names that Keyguard reads as Wi-Fi credentials, tags,
  item links, GPG keys, SSH certificates and environments.
url: https://keyguard.dev/docs/item-extras/
platforms:
  - android
  - linux
  - macos
  - windows
premium: false
---

# Custom field conventions

Keyguard reads these custom-field names as extra item data. Other clients show them as plain custom fields.

## Environments

On a Bitwarden server, an **Environment** item is stored as a secure note with these hidden fields.

| Field | Value |
| - | - |
| `keyguard.environment.v1.part.1`, `keyguard.environment.v1.part.2`, … | The environment’s variables, split into parts of at most 3,500 bytes |
| `keyguard.environment.v1.sha256` | Checksum of the joined parts |

## GPG keys

On a Bitwarden server, a GPG key item is stored as a secure note with these fields.

| Field | Type | Value |
| - | - | - |
| `keyguard.gpg.private_key.armored` | Hidden | Armored private key, if the item has one |
| `keyguard.gpg.public_key.armored` | Text | Armored public key |
| `keyguard.gpg.fingerprint` | Text | Fingerprint of the primary key |

A key longer than 3,500 bytes is split into numbered fields, such as `keyguard.gpg.public_key.armored.v1.part.1`, plus a `keyguard.gpg.public_key.armored.v1.sha256` checksum field.

## Item links

Keyguard stores each of an item’s [Linked items](https://keyguard.dev/docs/items/#linked-items) as a text custom field. KeePass databases store them as entry string fields with the same names.

| Field | Value |
| - | - |
| `keyguard.link.1`, `keyguard.link.2`, … | `keyguard://cipher/<ITEM_ID>`, the ID of the linked item in the same account |

Numbers start at 1, without gaps. Keyguard hides these fields from the item’s custom fields. A field with an invalid value stays a regular custom field.

## SSH bookmarks

A text field of an **SSH Key** item is a bookmark when its value starts with `ssh://`. Its name doesn’t matter. Keyguard shows bookmarks under **SSH bookmarks** instead of the custom fields, and saves a new one in a field named `SSH bookmark`. A value without `ssh://` gets it on save. [Pin hosts to keys](https://keyguard.dev/docs/ssh-agent/#pin-hosts-to-keys) uses bookmarks to offer each host only its own keys.

| Value | Example |
| - | - |
| `ssh://<HOST>` | `ssh://my-alias` |
| `ssh://<USER>@<HOST>:<PORT>` | `ssh://deploy@build.example.com:2222` |

The host is a host name, an alias from `~/.ssh/config` or an IP address, with IPv6 in brackets. The user and the port are optional; the port isn’t used for pinning. Keyguard skips values with a path or a pattern, such as `*`.

## SSH certificates

On a Bitwarden server, the certificate of an **SSH Key** item is stored in a text field.

| Field | Value |
| - | - |
| `keyguard.ssh.certificate` | The OpenSSH certificate line |

A certificate longer than 3,500 bytes is split into numbered fields, such as `keyguard.ssh.certificate.v1.part.1`, plus a `keyguard.ssh.certificate.v1.sha256` checksum field.

## Tags

In a Bitwarden account, Keyguard stores each tag as a custom field. KeePass databases use KeePass tags instead.

| Field | Value |
| - | - |
| `Tag` | The tag’s name, in a text field |

Keyguard writes tags back in the same format.

## Wi-Fi credentials

An item shows a Wi-Fi QR code when it has a network name and at least one of the other two fields. A login’s username then shows as **SSID**.

| Field | Value |
| - | - |
| `WiFi SSID` or `SSID` | Network name. A login’s username, if set, takes its place. |
| `WiFi Authentication Type` | `WPA`, `WEP`, or `nopass` for an open network |
| `WiFi Hidden` | `true` or `false` |

## Related

- [Items and fields](https://keyguard.dev/docs/items/)
- [GPG keys](https://keyguard.dev/docs/gpg-keys/)
- [Environments](https://keyguard.dev/docs/environments/)
- [Search](https://keyguard.dev/docs/search/)