Keep a passphrase on your SSH key and still not retype it

Protect your private key with a passphrase, then let ssh-agent hold the unlocked key so Git does not ask every time. On macOS, you can store the passphrase in the Keychain. On Windows, if Git keeps prompting, it may be using its own bundled ssh.exe.

Why the passphrase matters

GitHub's guidance is direct: anyone who obtains your key file could use it if the key has no passphrase. A laptop backup, a synced folder or a stolen disk image would all carry the key along.

The passphrase turns a copied file into a file that still needs one more secret.

ssh-agent in two commands

The agent holds the unlocked key in memory so you enter the passphrase once per session. GitHub's page gives the sequence:

eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519

Adjust the path to your key. If you are choosing a key type first, see the post on Ed25519 or RSA.

macOS Keychain

On macOS Sierra 10.12.2 or later, GitHub says to add these lines under Host github.com in ~/.ssh/config:

Host github.com
  AddKeysToAgent yes
  UseKeychain yes
  IdentityFile ~/.ssh/id_ed25519

Then store the passphrase in the Keychain:

ssh-add --apple-use-keychain ~/.ssh/id_ed25519

Two details from the same page. Omit UseKeychain if your key has no passphrase. And use Apple's built-in ssh-add, not a version from Homebrew or MacPorts, because the Keychain flag is Apple's.

The IdentityFile line is a common addition; check it against your own layout.

The Windows prompt that keeps coming back

GitHub notes a Windows quirk. If Git still prompts for your passphrase after you add the key to the Windows agent, Git may be using its bundled ssh.exe. The fix is to set core.sshCommand to the system OpenSSH binary.

Confirm the path of the system binary on your machine before you set it, since it depends on your install.

What the agent trades away

An agent is convenient because the unlocked key sits in memory. Malware running as you could ask the agent to sign things. That is the argument for hardware-backed keys and for keeping the agent's lifetime short. Neither is documented on the page cited here, so treat them as design choices to evaluate.

Checklist

1. Every private key has a passphrase.
2. The agent starts at login, or you start it per session.
3. On macOS, the Keychain option is configured with Apple's ssh-add.
4. On Windows, Git uses the same OpenSSH as the agent.
5. You know where each public key is registered.

Quick check

Sources

• Generating a new SSH key and adding it to the ssh-agent (GitHub Docs)

Last reviewed: 19 October 2026.