Change a key's passphrase
Change or remove the passphrase of an existing key with ssh-keygen -p. Pass -P and -N only in a throwaway demo, since they put secrets in the process list.
A private key has a passphrase you want to change, or one you set at creation and now want to rotate.
ssh-keygen -q -t ed25519 -f ./k -N 'old pass' -C [email protected]
ssh-keygen -p -f ./k -P 'old pass' -N 'new pass'
ssh-keygen -y -f ./k -P 'old pass' 2>&1 | head -1
ssh-keygen -y -f ./k -P 'new pass' | cut -d' ' -f1Key has comment '[email protected]'
Your identification has been saved with the new passphrase.
Load key "./k": incorrect passphrase supplied to decrypt private key
ssh-ed25519-p re-encrypts the private key file in place under a new passphrase, and the public key does not change, so nothing needs to be redeployed. The two lines after it prove the swap: the old passphrase is now refused and the new one reads the key. The behaviour is in the ssh-keygen manual. Run ssh-keygen -p -f key with no other flags to be prompted for both passphrases.
-P and -N appear in the process list and the shell history while the command runs, so use them only for throwaway keys. An empty -N '' removes the passphrase completely. The comment stays with the key.