public String getPassphrase(KeeperRecord record) {

        KeeperRecordData data = record.getData();
        List<KeeperRecordField> fields = data.getFields();
        List<KeeperRecordField> custom = data.getCustom();

        // For records with a standard keypair field, the passphrase is the
        // standard password field
        if (getField(fields, KeyPairs.class, null) != null) {
            Password passwordField = getField(fields, Password.class, null);
            if (passwordField != null)
                return getSingleStringValue(passwordField.getValue());
        }

        // For records WITHOUT a standard keypair field, the passphrase can
        // only reasonably be a custom field (consider a "Login" record with
        // a pair of custom hidden fields for the private key and passphrase:
        // the standard password field of the "Login" record refers to the
        // user's own password, if any, not the passphrase of their key)

        // Use password "private key" custom field as fallback ...
        Password passwordField = getField(custom, Password.class, PASSPHRASE_LABEL_PATTERN);
        if (passwordField != null)
            return getSingleStringValue(passwordField.getValue());

        // ... or hidden "private key" custom field
        HiddenField hiddenField = getField(custom, HiddenField.class, PASSPHRASE_LABEL_PATTERN);
        if (hiddenField != null)
            return getSingleStringValue(hiddenField.getValue());

        return null;

    }
Returns the passphrase for the private key associated with the given
record. Both standard and custom fields are searched. Only "Password"
and "Hidden" field types are considered. Custom fields must additionally
have the label "passphrase" (case-insensitive). Note that there is no
specific association between private keys and passphrases in the
"KeyPairs" field type.

@param record
    The record to retrieve the passphrase from.

@return
    The passphrase for the private key associated with the given record,
    or null if there is no such passphrase associated with the record.
extensions/guacamole-vault/modules/guacamole-vault-ksm/src/main/java/org/apache/guacamole/vault/ksm/secret/KsmRecordService.java