421

I have an existing public/private key pair. The private key is password protected, and the encryption may be either RSA or DSA. These keys are the kind you generate with ssh-keygen and generally store under ~/.ssh.

I'd like to change the private key's password. How do I go about it, on a standard Unix shell?

Also, how do I simply remove the password? Just change it to empty?

0

3 Answers 3

561

To change the passphrase on your default key:

$ ssh-keygen -p

If you need to specify a key, pass the -f option:

$ ssh-keygen -p -f ~/.ssh/id_dsa

then provide your old and new passphrase (twice) at the prompts. (Use ~/.ssh/id_rsa if you have an RSA key.)

More details from man ssh-keygen:

[...]
SYNOPSIS
    ssh-keygen [-q] [-b bits] -t type [-N new_passphrase] [-C comment]
               [-f output_keyfile]
    ssh-keygen -p [-P old_passphrase] [-N new_passphrase] [-f keyfile]
[...]
     -f filename
             Specifies the filename of the key file.
[...]
     -N new_passphrase
             Provides the new passphrase.

     -P passphrase
             Provides the (old) passphrase.

     -p      Requests changing the passphrase of a private key file instead of
             creating a new private key.  The program will prompt for the file
             containing the private key, for the old passphrase, and twice for
             the new passphrase.
[...]
12
  • 1
    This is from the man page shipping with net-misc/openssh-5.2_p1-r2 on Gentoo Linux.
    – Mike Mazur
    Aug 6, 2009 at 6:04
  • 20
    Also, for the sake of future lazy person, I'd reverse the order: quick answser first, man page later.
    – kch
    Aug 6, 2009 at 6:15
  • 2
    I think the answer is great since it both shows where you can change the password, and where to look for the answer. I've helped a lot of people setting up ssh keys, and for them actually remembering which tool they have used isn't always easy. Besides, searching for the answer on the 'net is the first option for many...
    – sastorsl
    May 4, 2015 at 6:26
  • 7
    If your machines use OpenSSH >= 6.5, you should be using the -o option to enable the new private key format (bcrypt as KDF by default). With older OpenSSH versions, use PKCS#8 for more secure private key files. Aug 5, 2015 at 18:14
  • 2
    @FranciscoLuz the command in my answer is specific to a DSA key. If you have an RSA key, then your command is correct. I added a blurb to the answer to address this.
    – Mike Mazur
    Aug 27, 2015 at 15:02
3

If you don't have ssh-keygen installed, you can also use openssl directly

key="/path/to/your.key"
algo="-des3" # or -aes256 or ...

openssl rsa $algo -in "$key" -out "$key.new"

# and replace old key with new one
mv "$key.new" "$key"
3
  • "Cannot find private key"
    – chx101
    Dec 2, 2022 at 8:29
  • @chx101 : I guess you didn't give the correct path to your key in the $key variable.
    – mivk
    Dec 2, 2022 at 12:13
  • Hmmm.. It's in the same directory. ssh-keygen works with no issues.
    – chx101
    Dec 2, 2022 at 13:49
-16

Remove your SSH public/private keys:

rm ~/.ssh/id_rsa*

Recreate the keypair, choosing a new passphrase:

ssh-keygen -t rsa -f ~/.ssh/id_rsa

Add the newly created private key to your OS X Keychain to store the passphrase and manage unlocking it automatically:

ssh-add -K ~/.ssh/id_rsa

Copy the public key to the OS X clipboard for adding to web services like GitHub, etc.

cat ~/.ssh/id_rsa.pub | pbcopy

Add your newly created public key to the ~/.ssh/authorized_keys file of the remote server. Be sure to ensure the correct permissions of both the remote ~/.ssh folder (700) and ~/.ssh/authorized_keys (600). You may want to investigate using ssh-copy-id to ease this process.

3
  • 12
    The poster asked how to change passphrase on their key, not throw it away and generate a new one; and they never mentioned OS X. Aug 13, 2018 at 12:17
  • 7
    I would have upvoted this answer if it wasn't for these three issues: 1. Deleting the old keys isn't a good start since you'll need those when updating authorized_keys. 2. You haven't mentioned why creating new keys is better than changing passwords on the old. 3. You make assumptions about OS, which is not supported by the question.
    – kasperd
    Oct 18, 2018 at 19:53
  • This is replacing the keys entirely, not replacing the password. Read the question carefully and if you don't know, then don't answer. Feb 21, 2023 at 12:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .