Give every SSH private key a passphrase and let ssh-agent hold the unlocked key for you. Without a passphrase, anyone who gets onto your computer can reach every system that trusts that key. With one, a copied key file is far less useful on its own.
What a passphrase does
GitHub's documentation puts it plainly: a passphrase adds a layer of protection, and without one, anyone with access to your computer can reach every system that uses the key. The passphrase encrypts the private key file on disk. Stealing the file is not enough.
It does not stop malware that runs as you while the key is loaded in memory. That is a separate problem, and one reason to look at hardware backed keys.
Add or change a passphrase without a new key
You can change a passphrase without regenerating the key pair:
ssh-keygen -p -f ~/.ssh/id_ed25519
If the key already has a passphrase you enter it first. Entering an empty new passphrase removes protection, so do not do that on a laptop.
What ssh-agent is for
Typing a passphrase for every connection is miserable, which is why people strip passphrases. ssh-agent solves that by caching the unlocked key.
eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519
GitHub notes the agent runs until you log out, shut down or kill the process. You can make it forget a key after a set time with the -t option followed by a number of seconds:
ssh-add -t 28800 ~/.ssh/id_ed25519
That example is eight hours, a working day. Pick a value that fits how your team works.
On macOS, you can also store the passphrase in the keychain so you are not prompted again. The exact flags differ by macOS version, so follow the macOS setup guide.
An audit you can run today
- List the keys in your agent with
ssh-add -l. - Look in
~/.sshfor private keys with no passphrase. Test each withssh-keygen -y -fand a path. If it prints a public key without asking for a passphrase, the key is unprotected. - Add passphrases or replace those keys.
- Delete keys you no longer use from both disk and the servers and services that trust them.
- Keep one key per device, so that a lost laptop means deleting one entry.
Policy wording that works
- Every SSH key used for company systems has a passphrase.
- Keys are generated on the device that will use them and are not copied between machines.
- Keys for production access have a time limit in the agent, or use a hardware key.
- Lost devices have their keys removed within the hour. See the lost laptop checklist.
Quick check
Is a passphrase the same as my login password?
No. It is a separate secret that encrypts the private key file. Do not reuse your login password for it.
Does ssh-agent make my key less safe?
It keeps the unlocked key in memory so malware running as you could use it. A timeout and a hardware key reduce that risk. The trade is that without an agent people tend to drop passphrases altogether.
Sources
- Working with SSH key passphrases, GitHub Docs
- Generating a new SSH key and adding it to the ssh-agent, GitHub Docs
Last reviewed: 19 October 2026.
