I have an existing public/private key pair. The private key is password protected, and the encryption may be either RSA or DSA. These keys are the kind you generate with ssh-keygen and generally store under ~/.ssh.

I'd like to change the private key's password. How do I go about it, on a standard Unix shell?

Also, how do I simply remove the password? Just change it to empty?


To change the passphrase on your default DSA key:

$ ssh-keygen -p -f ~/.ssh/id_dsa

then provide your old and new passphrase (twice) at the prompts. (Use ~/.ssh/id_rsa if you have an RSA key.)

More details from man ssh-keygen:

    ssh-keygen [-q] [-b bits] -t type [-N new_passphrase] [-C comment]
               [-f output_keyfile]
    ssh-keygen -p [-P old_passphrase] [-N new_passphrase] [-f keyfile]
     -f filename
             Specifies the filename of the key file.
     -N new_passphrase
             Provides the new passphrase.

     -P passphrase
             Provides the (old) passphrase.

     -p      Requests changing the passphrase of a private key file instead of
             creating a new private key.  The program will prompt for the file
             containing the private key, for the old passphrase, and twice for
             the new passphrase.
| improve this answer | |
  • 1
    This is from the man page shipping with net-misc/openssh-5.2_p1-r2 on Gentoo Linux. – Mike Mazur Aug 6 '09 at 6:04
  • 17
    Also, for the sake of future lazy person, I'd reverse the order: quick answser first, man page later. – kch Aug 6 '09 at 6:15
  • 2
    I think the answer is great since it both shows where you can change the password, and where to look for the answer. I've helped a lot of people setting up ssh keys, and for them actually remembering which tool they have used isn't always easy. Besides, searching for the answer on the 'net is the first option for many... – sastorsl May 4 '15 at 6:26
  • 6
    If your machines use OpenSSH >= 6.5, you should be using the -o option to enable the new private key format (bcrypt as KDF by default). With older OpenSSH versions, use PKCS#8 for more secure private key files. – Quinn Comendant Aug 5 '15 at 18:14
  • 2
    @FranciscoLuz the command in my answer is specific to a DSA key. If you have an RSA key, then your command is correct. I added a blurb to the answer to address this. – Mike Mazur Aug 27 '15 at 15:02

Remove your SSH public/private keys:

rm ~/.ssh/id_rsa*

Recreate the keypair, choosing a new passphrase:

ssh-keygen -t rsa -f ~/.ssh/id_rsa

Add the newly created private key to your OS X Keychain to store the passphrase and manage unlocking it automatically:

ssh-add -K ~/.ssh/id_rsa

Copy the public key to the OS X clipboard for adding to web services like GitHub, etc.

cat ~/.ssh/id_rsa.pub | pbcopy

Add your newly created public key to the ~/.ssh/authorized_keys file of the remote server. Be sure to ensure the correct permissions of both the remote ~/.ssh folder (700) and ~/.ssh/authorized_keys (600). You may want to investigate using ssh-copy-id to ease this process.

| improve this answer | |
  • 4
    The poster asked how to change passphrase on their key, not throw it away and generate a new one; and they never mentioned OS X. – musicinmybrain Aug 13 '18 at 12:17
  • 3
    I would have upvoted this answer if it wasn't for these three issues: 1. Deleting the old keys isn't a good start since you'll need those when updating authorized_keys. 2. You haven't mentioned why creating new keys is better than changing passwords on the old. 3. You make assumptions about OS, which is not supported by the question. – kasperd Oct 18 '18 at 19:53

Not the answer you're looking for? Browse other questions tagged or ask your own question.