TechEarl

Change or Remove an SSH Key Passphrase

Add, change, or remove the passphrase on an existing SSH key with ssh-keygen -p. No need to regenerate the key or reinstall it on any server.

Ishan Karunaratne⏱️ 3 min readUpdated
Share thisCopied
Add, change, or remove the passphrase on an existing SSH private key with ssh-keygen -p, without regenerating the key.

The passphrase on an SSH key encrypts the private key file at rest. It is independent of the keypair itself, so you can add, change, or remove it any time without regenerating anything. The public key and the fingerprint do not change, so you never have to reinstall the key on servers or GitHub.

Try it with your own values

Pick your OS for the right path form.

Change (or add) a passphrase

bash· Linux (GNU)
ssh-keygen -p -f ~/.ssh/id_ed25519

It prompts for the old passphrase (press Enter if there is none), then the new one twice. To add a passphrase to a key that never had one, the same command works: leave the old passphrase blank and set a new one.

Remove a passphrase

Set the new passphrase to empty. Either run the command above and press Enter at the "new passphrase" prompts, or do it non-interactively:

bash· Linux (GNU)
ssh-keygen -p -f ~/.ssh/id_ed25519 -N ''

Removing a passphrase is convenient for unattended jobs (CI, cron, deploy keys), but it means a stolen key file is immediately usable. Only do it on machines you control, and prefer a scoped deploy key over your personal key for automation.

Stop typing the passphrase every time

If the prompt is the only reason you want to remove the passphrase, do not. Load the key into the agent once per session instead:

bash· Linux (GNU)
eval "$(ssh-agent -s)" && ssh-add ~/.ssh/id_ed25519

On macOS, --apple-use-keychain stores it so it survives reboots. That gives you the security of a passphrase with the convenience of none.

FAQ

No. The passphrase only encrypts the private key file on disk. The keypair, the public key, and the SHA256 fingerprint are unchanged, so nothing on any server or in GitHub needs updating.

No. There is no recovery; the passphrase is not stored anywhere. You have to generate a new key and reinstall its public half wherever the old one was trusted. See how to create an SSH key.

Only on a machine you fully control, and even then it is a convenience trade-off: a passphrase-free private key is usable the instant it is copied. For automation, prefer a dedicated deploy key with a narrow scope, and lean on ssh-agent rather than removing the passphrase on your personal key.

See also

Sources

Authoritative references this article was fact-checked against.

TagsSSHssh-keygenpassphrasessh-agentSecurityLinux

Found this useful? Pass it on.

Copied

Ishan Karunaratne

Software Systems Architect · Senior Software Engineer · Engineering Leadership

Software systems architect and senior software engineer with more than two decades designing, building, and running production software, Linux systems, and DevOps infrastructure, and lately working AI into the stack. Now a CTO, though what I write here is drawn from the full arc of that work, across architecture, engineering, and operations, not any single job.

More by Ishan →LinkedIn
Keep reading

Related posts

Generate an SSH key with ssh-keygen: pick Ed25519 over RSA, decide on a passphrase, and set the ~/.ssh permissions SSH needs. Linux, macOS and Windows.
Linux

How to Create an SSH Key in 2026

Create an SSH key in one ssh-keygen command. Which key type to pick in 2026 (Ed25519 vs RSA), whether to set a passphrase, and the file permissions SSH needs, on Linux, macOS and Windows.

Four reliable ways to change a WordPress password: admin dashboard, WP-CLI, direct in the database, or email reset. Includes the WP 6.8+ bcrypt hash format.
WordPress

How to Change a WordPress Password

Four reliable ways to change a WordPress password: admin dashboard, WP-CLI, directly in the database with the correct phpass or bcrypt hash, and the lost-password email reset.