Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an existing public/private key pair, the private key is password protected, the encryption may be either RSA or DSA. These keys are the kind you generate with ssh-keygen and generally store under ~/.ssh.

I'd like to change the private key's password. How do I go about it, on a standard unix shell?

Also, how do I simply remove the password? Just change it to empty?

(I know, they call it a passphrase. Pedantic wimps.)

share|improve this question
up vote 100 down vote accepted

To change the passphrase on your default DSA key:

$ ssh-keygen -p -f ~/.ssh/id_dsa

then provide your old and new passphrase (twice) at the prompts. (Use ~/.ssh/id_rsa if you have an RSA key.)

More details from man ssh-keygen:

    ssh-keygen [-q] [-b bits] -t type [-N new_passphrase] [-C comment]
               [-f output_keyfile]
    ssh-keygen -p [-P old_passphrase] [-N new_passphrase] [-f keyfile]
     -f filename
             Specifies the filename of the key file.
     -N new_passphrase
             Provides the new passphrase.

     -P passphrase
             Provides the (old) passphrase.

     -p      Requests changing the passphrase of a private key file instead of
             creating a new private key.  The program will prompt for the file
             containing the private key, for the old passphrase, and twice for
             the new passphrase.
share|improve this answer
This is from the man page shipping with net-misc/openssh-5.2_p1-r2 on Gentoo Linux. – Mike Mazur Aug 6 '09 at 6:04
Also, for the sake of future lazy person, I'd reverse the order: quick answser first, man page later. – kch Aug 6 '09 at 6:15
I think the answer is great since it both shows where you can change the password, and where to look for the answer. I've helped a lot of people setting up ssh keys, and for them actually remembering which tool they have used isn't always easy. Besides, searching for the answer on the 'net is the first option for many... – sastorsl May 4 '15 at 6:26
If your machines use OpenSSH >= 6.5, you should be using the -o option to enable the new private key format (bcrypt as KDF by default). With older OpenSSH versions, use PKCS#8 for more secure private key files. – Quinn Comendant Aug 5 '15 at 18:14
@FranciscoLuz the command in my answer is specific to a DSA key. If you have an RSA key, then your command is correct. I added a blurb to the answer to address this. – Mike Mazur Aug 27 '15 at 15:02

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.