Git keeps asking me for my ssh key passphrase

Question

I created keys as instructed in the GitHub tutorial, added them to GitHub, and tried using ssh-agent explicitly — yet git continues to ask me for my passphrase every time I try to do a pull or a push.

What could be the cause?

Future

Related: #14762534 – Courtship

Answer 1

Once you have started the SSH agent with:

eval $(ssh-agent)

Do either:

1. To add your private key to it:

    ssh-add
   

   This will ask you your passphrase just once, and then you should be allowed to push, provided that you uploaded the public key to Github.

2. To add and save your key permanently on macOS:

    ssh-add -K  
   

   This will persist it after you close and re-open it by storing it in user's keychain.

   If you see a warning about deprecated flags, try the new variant:

    ssh-add --apple-use-keychain 
   

3. To add and save your key permanently on Ubuntu (or equivalent):

     ssh-add ~/.ssh/id_rsa
   

Taw

log-out of the server, ssh back in, run git pull, prompt me for password again. – Chilung

This didn't work for me. It is still asking for passphrase when I close Gitbash and open it again. – Kinsfolk

@OmarTariq If you close your git-bash session, you lose the ssh-agent instance. Some desktop environments launch a global agent so added keys are shared across terminal sessions, but that's specific to the OS you are using. – Taw

I'd just like to add another bit of info: If you have multiple ssh keys, you may want to specify the path to a particular id_rsa in your ssh-add command, e.g. ssh-add /Users/rubyx/.ssh/git/id_rsa – Marvellamarvellous

ssh-add -K will persist it after you close and re-open it by storing it in user's keychain. – Responsion

@Responsion ssh-add -K gives the following: unknown option -- K usage: ssh-add [options] [file ...] Options: -l List fingerprints of all identities. -L List public key parameters of all identities. -k Load only keys and not certificates. -c Require confirmation to sign using identities -t life Set lifetime (in seconds) when adding identities. -d Delete identity. -D Delete all identities. -x Lock agent. -X Unlock agent. -s pkcs11 Add keys from PKCS#11 provider. – Sanctitude

This just prevents you having to retype it repeatedly. If you literally don't want any security, ever, then don't put a password on the key. – Tutu

I still get prompted for a passphrase regardless. – Chiu

I had to do this ssh-add -K ~/.ssh/id_rsa for it to persist on Mac. – Antipode

This was not working for me on Windows. But the following command solved my problem: git config credential.helper store After that I was asked one more time for my credentials, but after that no more. – Cranage

-K is apple specific. See help.github.com/articles/… – Fokine

The option in linux is -k in lower case. – Roundish

@PaulozOiOzuLLuFabrício I don't think that is correct, it lists -k as being the following on my Debian machine: -k Load only keys and not certificates. – Prent

@Cranage "Using this helper will store your passwords unencrypted on disk, protected only by filesystem permissions. If this is not an acceptable security tradeoff, try git-credential-cache[1], or find a helper that integrates with secure storage provided by your operating system. This command stores credentials indefinitely on disk for use by future git programs." – Vimineous

This worked for me. Thank you. Could you explain a little further how it works? – Bram

For Mac the k is in lower case not caps – Subscapular

That should be eval "${ssh-agent}" instead of eval ${ssh-agent}. – Ai

for mac OS you can use ssh-add --apple-use-keychain – Brancusi

--apple-use-keychain is new variant of -K see: WARNING: The -K and -A flags are deprecated and have been replaced by the --apple-use-keychain and --apple-load-keychain flags, respectively. To suppress this warning, set the environment variable APPLE_SSH_ADD_BEHAVIOR as described in the ssh-add(1) manual page. – Metagenesis

I don't think this reply answers the question (and seems to be OS-specific, while the question is not)... – Herzel

I tried everything else, but re-running ssh-add -K worked. – Droll

This doesn't work. I'm still getting prompted for my passphrase. – Manzo

Answer 2

This has been happening to me after restarts since upgrading from OS X El Capitan (10.11) to macOS Sierra (10.12). The ssh-add solution worked temporarily but would not persist across another restart.

The permanent solution was to edit (or create) ~/.ssh/config and enable the UseKeychain option.

Host *
    UseKeychain yes

Related: macOS keeps asking my ssh passphrase since I updated to Sierra

Contented

worked for me thanks... I had done... ssh-add -K /Users/***/.ssh/git/id_rsa but it was still not working after terminal restart... thank you. – Darell

Want to why this happen? Read the technical note on OpenSSH changes developer.apple.com/library/content/technotes/tn2449/… – Niblick

Thanks, the accepted solution wasn't enough, but your solution did the trick ! (I'm on a mac M1). – Rotenone

Had the ~/.ssh/config as per github tutorial and it didn't work. It worked only once added lines in this answer. Probably Host *.github.com wasn't working for github.com. – Whippletree

Thanks for this. I set min to Host *github*, which worked for me. I didn't want to use Host *, as I also SSH into a RaspberryPi with a different setup – Froufrou

Answer 3

If you've tried ssh-add and you're still prompted to enter your passphrase then try using ssh-add -K. This adds your passphrase to your keychain.

Update: if you're using macOS Sierra then you likely need to do another step as the above might no longer work. Add the following to your ~/.ssh/config:

Host *
  UseKeychain yes

Bubbler

Still prompts me for a passphrase. – Chiu

@Chiu Are you using macOS Sierra? If so, check out what I just added to the answer. I hope that helps. – Bubbler

Yes, I am on Sierra. However, here is the line that worked worked for me too: AddKeysToAgent yes – Chiu

This also works with BitBucket Cloud. I was having issues in GitKraken and this resolved my issues. – Potaufeu

Answer 4

I would try the following:

1. Start GitBash
2. Edit your ~/.bashrc file
3. Add the following lines to the file

SSH_ENV=$HOME/.ssh/environment

# start the ssh-agent
function start_agent {
    echo "Initializing new SSH agent..."
    # spawn ssh-agent
    /usr/bin/ssh-agent | sed 's/^echo/#echo/' > ${SSH_ENV}
    echo succeeded
    chmod 600 ${SSH_ENV}
    . ${SSH_ENV} > /dev/null
    /usr/bin/ssh-add
}

if [ -f "${SSH_ENV}" ]; then
     . ${SSH_ENV} > /dev/null
     ps -ef | grep ${SSH_AGENT_PID} | grep ssh-agent$ > /dev/null || {
        start_agent;
    }
else
    start_agent;
fi

4. Save and close the file
5. Close GitBash
6. Reopen GitBash
7. Enter your passphrase

Odeen

For future reference, this also works with zsh. Just add this to .zshrc – Ot

I believe this assumes your keyfile is called id_rsa. If you have a custom name, you should use eg. /usr/bin/ssh-add ~/.ssh/custom_filename – Callie

Can you explain what happen to this script? – Sesterce

@Lee it starts the ssh-agent if not already running, which is what makes sure not to ask you the ssh passphrase on every push (more or less). – Odeen

This just runs ssh-agent and adds the key on every login. You still have to enter password each time you login. So for example if you have scripts ssh-ing and doing GIT commands, this is unfortunately not useful at all. – Mayramays

@Mayramays It is not true for me. I had to add a password only once. I think the reason is that it creates .ssh/environment. – Emmittemmons

Where is .bashrc file located? – Hanging

@Hanging in your home directory (~/ points to the home dir). – Odeen

@Odeen It doesn't work for me on windows if home dir is C:\Users\%userprofile%`, not for ~/.profile` not for ~/.bashrc – Hanging

Answer 5

What worked for me on Windows was (I had cloned code from a repo 1st):

eval $(ssh-agent)
ssh-add 
git pull 

at which time it asked me one last time for my passphrase

Credits: the solution was taken from https://unix.stackexchange.com/questions/12195/how-to-avoid-being-asked-passphrase-each-time-i-push-to-bitbucket

Paten

if you are using a non default rsa file name, then be sure to use it on the second command: ssh-add /c/Users/you_user/.ssh/id_rsa_abcxyz – Mullane

this only works while the gitbash is active for me. Once I close it, again I need to provide credentials – Peacetime

Answer 6

Try adding this to your ~/.ssh/config:

Host *
   AddKeysToAgent yes
   UseKeychain yes
   IdentityFile ~/.ssh/id_rsa

... assuming your private key is named id_rsa

Chiu

UseKeychain yes is only valid for mac – Francoise

@Oz123 what's the equivalent for windows – Chiu

@Oz123 I think the equivalent on Windows is AddKeysToAgent yes check this answer #52424126 – Vimineous

This is a much more universal answer than the others (works on any OS, except for the UseKeyChain part). I should be the accepted answer IMHO. Thanks @Chiu – Polyandrist

Excellent. How would you go about specifying several ssh keys if you have accounts in Gitlab, Github, etc. and you are managing projects locally to push to those? – Gird

@EmmanuelGoldstein For your case, instead of Host *, you'd specify each Host name separately. – Chiu

Answer 7

previously -K flag is used to add key but now:

ssh-add --apple-use-keychain

The -K and -A flags are deprecated and have been replaced by the --apple-use-keychain and --apple-load-keychain flags, respectively.

---

LATER EDIT: you may need to add ssh-add --apple-load-keychain -q to your .bash_profile or .bashrc or .zshrc or equivalent.

Ironworks

For me this, worked. I was trying to import a private github repo via SSH – Folderol

I had to to do that and also add ssh-add --apple-load-keychain -q to my .bash_profile (or .zshrc if you use zsh). – Costanzo

Same here, I had to add what @AndréWillikValenti said to my .zshrc – Corundum

Thanks @alexventuraio, I added that step to the original answer. – Costanzo

Answer 8

Run the following:

eval $(ssh-agent) && ssh-add ~/.ssh/id_rsa &>/dev/null

Enter the passphrase, then check git. Git should not ask for passphrase after this command.

The original source: https://gist.github.com/egoens/c3aa494fc246bb4828e517407d56718d

Mercaptopurine

Answer 9

If you are not using GitBash and are on Windows - you need to start your ssh-agent using this command

start-ssh-agent.cmd

If your ssh agent is not set up, you can open PowerShell as admin and set it to manual mode

Get-Service -Name ssh-agent | Set-Service -StartupType Manual

Stead

I started the agent but it still asks me for my passphrase every time – Scriptorium

Answer 10

If the above solutions are not working for me, one thing to check is that you actually have the public key too (typically id_rsa.pub). It is unusual not to, but that was the cause for me.

To create your public key from your private key:

ssh-keygen -y -f ~/.ssh/id_rsa > ~/.ssh/id_rsa.pub

Boredom

This did it for me! Thanks! :) – Joycelynjoye

Answer 11

I had a similar issue, but the other answers didn't fix my problem. I thought I'd go ahead and post this just in case someone else has a screwy setup like me.

It turns out I had multiple keys and Git was using the wrong one first. It would prompt me for my passphrase, and I would enter it, then Git would use a different key that would work (that I didn't need to enter the passphrase on).

I just deleted the key that it was using to prompt me for a passphrase and now it works!

Sev

Answer 12

In case you are on Win10:

I had the same problem. (previously had to update ssh-agent individually with a script from here because of a different problem)

Git did access my ssh config (git pull threw exceptions when I had nonsense-lines in ssh config), but never seemed to care about the private key I had added via ssh-agent and referenced in my config.

What fixed the problem was to execute the following command in PowerShell:

git config core.sshCommand (get-command ssh).Source.Replace('\','/')

(Details are in this link)

Keith

Answer 13

It sounds like you may be having trouble with SSH-Agent itself. I would try troubleshooting that.

1) Did you do ssh-add to add your key to SSH?

2) Are you closing the terminal window between uses, because if you close the window you will have to enter the password again when you reopen it.

Haas

Would be nice to add information on how to solve the first problem Jeff Welling. – Ferrick

Answer 14

For Windows or Linux users, a possible solution is described on GitHub Docs, which I report below for your convenience.

You can run ssh-agent automatically when you open bash or Git shell. Copy the following lines and paste them into your ~/.profile or ~/.bashrc file:

env=~/.ssh/agent.env

agent_load_env () { test -f "$env" && . "$env" >| /dev/null ; }

agent_start () {
    (umask 077; ssh-agent >| "$env")
    . "$env" >| /dev/null ; }

agent_load_env

# agent_run_state: 0=agent running w/ key; 1=agent w/o key; 2= agent not running
agent_run_state=$(ssh-add -l >| /dev/null 2>&1; echo $?)

if [ ! "$SSH_AUTH_SOCK" ] || [ $agent_run_state = 2 ]; then
    agent_start
    ssh-add
elif [ "$SSH_AUTH_SOCK" ] && [ $agent_run_state = 1 ]; then
    ssh-add
fi

unset env

If your private key is not stored in one of the default locations (like ~/.ssh/id_rsa), you'll need to tell your SSH authentication agent where to find it. To add your key to ssh-agent, type ssh-add ~/path/to/my_key.

Now, when you first run Git Bash, you are prompted for your passphrase. The ssh-agent process will continue to run until you log out, shut down your computer, or kill the process.

Stockade

Here's the link to the specific section on the page Auto-launching ssh-agent on Git for Windows. Note: You must select the "Windows" tab on the page to see this section... there is no Linux tab listed, so I find this confusing on GitHub's part. – Steelyard

Where is this ~/.profile file is located? – Hanging

@Hanging you have to create it (if it doesn't exist) in C:\Users\<your-user>\.profile The "~" in a path, like "~/.profile", usually means your system user folder. – Antipyrine

Answer 15

I try different solutions but nothing help. But this steps (My GitBash SSH environment always asks for my passphrase, what can I do?) from Bitbucket.com seams works well :

The idea is:

1. you create ~/.bashrc file

2. add follow script:

    SSH_ENV=$HOME/.ssh/environment
   
    # start the ssh-agent
    function start_agent {
        echo "Initializing new SSH agent..."
        # spawn ssh-agent
        /usr/bin/ssh-agent | sed 's/^echo/#echo/' > "${SSH_ENV}"
        echo succeeded
        chmod 600 "${SSH_ENV}"
        . "${SSH_ENV}" > /dev/null
        /usr/bin/ssh-add
    }
   
    if [ -f "${SSH_ENV}" ]; then
        . "${SSH_ENV}" > /dev/null
        ps -ef | grep ${SSH_AGENT_PID} | grep ssh-agent$ > /dev/null || {
            start_agent;
        }
    else
        start_agent;
    fi
   

3. re-run Bash

Cassiecassil

Answer 16

Another possible solution that is not mentioned above is to check your remote with the following command:

git remote -v

If the remote does not start with git but starts with https you might want to change it to git by following the example below.

git remote -v // origin is https://github.com/user/myrepo.git
git remote set-url origin [email protected]:user/myrepo.git
git remote -v // check if remote is changed

Hulse

This worked for me. in my case, I mistakenly set remote to [email protected] instead of github.com. – Biodegradable

worked for me as well, I didn't specify the user anymore, just this; origin [email protected]/myrepo.git – Sailcloth

Answer 17

on mac, if your ssh key need passphrase everytime and you want to skip it, then you can try below, it works fine for me

1. eval "$(ssh-agent -s)"
2. ssh-add -K .ssh/id_rsa
3. add this default ssh configuration works for me

Host *
AddKeysToAgent yes
UseKeychain yes
IdentityFile ~/.ssh/id_rsa

Octosyllable

Answer 18

Update the url of the origin remote using SSH instead of HTTPS;

git remote set-url origin "SSH URL COPIED FROM GIT REPO."

This what works with me.

Prod

Answer 19

If you happen to be using fish, there's a gist for it:

# config.fish
if not pgrep -f ssh-agent > /dev/null
  eval (ssh-agent -c)
  set -Ux SSH_AUTH_SOCK $SSH_AUTH_SOCK
  set -Ux SSH_AGENT_PID $SSH_AGENT_PID
  set -Ux SSH_AUTH_SOCK $SSH_AUTH_SOCK
end

Soerabaja

Answer 20

This command from GitHub Docs did the trick for me:

> Enter old passphrase: [Type old passphrase]
> Key has comment '[email protected]'
> Enter new passphrase (empty for no passphrase): [Type new passphrase]
> Enter same passphrase again: [Repeat the new passphrase]
> Your identification has been saved with the new passphrase.

Hawaiian

I don't think this will work. Just changing to a new password won't help much and an empty password is discouraged. – Houck

Answer 21

Seems that your local repo hasnt updated with ssh keys...at least this is what happened to me when going from https to ssh.

Have you done a remote reset?

git remote set-url origin <ssh url>

Detrude

Answer 22

Idk if someone needs something different but this help me a lot https://mcmap.net/q/54899/-running-script-upon-login-in-mac-os-x-closed

To me on every restart, I have to run ssh-add --apple-use-keychain to load credentials, so I add this command to the stack overflow answer and now its fixed

Grondin

Answer 23

For skipping the passphrase we can create key without passphrase ))) But if this isn't a way to go For Windows I'm using the ssh-agent, you can add private key in it and remove from .ssh folder. How to setup ssh-agent:

# Check the current status of ssh-agent:
Get-Service | ?{$_.Name -like '*ssh-agent*'} | select -Property Name, StartType, Status

# Start the Service:
Start-Service ssh-agent

# Add your key as before:
ssh-add <path to the key>

ssh-agent works with C:\Windows\System32\OpenSSH\ssh.exe So we can setup this ssh.exe for git by creating environment variable:

GIT_SSH: C:\Windows\System32\OpenSSH\ssh.exe

This will be working for Git and Bash.

Also we can setup this path for TortoiseGit: Settings>Network>SSH>SSH Client

Hanging

Answer 24

you should now use ssh-add --apple-use-keychainon zsh, MacOS Sonoma

Affianced

Already suggested in an earlier answer in https://mcmap.net/q/53601/-git-keeps-asking-me-for-my-ssh-key-passphrase by @Ironworks – Hokusai

Answer 25

Maybe not the most secure way to fix this, but simply do not set a passphrase, it is optional. If you don't set a passphrase, it will not ask for it. You can change the passphrase with

$ ssh-keygen -p -f ~/.ssh/id_ed25519
> Enter old passphrase: [Type old passphrase]
> Key has comment '[email protected]'
> Enter new passphrase (empty for no passphrase): [Type new passphrase]
> Enter same passphrase again: [Repeat the new passphrase]
> Your identification has been saved with the new passphrase.

Oncoming

don't do this folks, simply no. – Vardhamana