Load key "/path/to/key": incorrect passphrase supplied to decrypt private key

Interactive `ssh-add` asks again with "Bad passphrase, try again for …:"; `ssh` itself just prompts again.

OpenSSH (ssh-keygen, ssh-add, ssh) — encrypted private key

What it means

The key file parsed fine and is encrypted; decrypting it with the passphrase you supplied failed. OpenSSH can tell this apart from a damaged file because the encrypted container includes a check value — so this message really means "wrong passphrase", for OpenSSH-format keys and for encrypted PEM/PKCS#8 keys alike. There is no way to recover a forgotten passphrase; the key has to be replaced.

Why it happens

• The passphrase is not the one set on this key

  common

  Several keys with different passphrases, or a key whose passphrase was changed with `ssh-keygen -p` on another machine.

• Extra characters from a file or variable

  occasional

  Passphrases read from files or secrets with a trailing newline or quotes, passed via `-P` or `SSH_ASKPASS` scripts.

• Keyboard layout or caps lock

  occasional

  Passphrases with characters that move between layouts (y/z, special characters) fail on a machine with a different layout.

How to fix it

1. 1.

   Test the passphrase interactively

   If `ssh-keygen -y` accepts the passphrase you type, the problem is in how your script supplies it.

   ssh-keygen -y -f ~/.ssh/id_ed25519 > /dev/null   # prompts; succeeds only with the right passphrase
   ssh-keygen -p -f ~/.ssh/id_ed25519                # change the passphrase (needs the old one)

2. 2.

   Use an agent instead of passing passphrases

   Unlock the key once in `ssh-agent` (or the OS keychain) rather than embedding the passphrase in scripts or CI.

   # Unlock once per session instead of typing or storing the passphrase in scripts
   eval "$(ssh-agent -s)"
   ssh-add ~/.ssh/id_ed25519
   # macOS: keep it in the keychain
   ssh-add --apple-use-keychain ~/.ssh/id_ed25519

← Browse the full signature error database