Stop SSH asking for your passphrase every time (ssh-agent)

Stop SSH asking for your passphrase every time

If SSH keeps prompting Enter passphrase for key on every connection, you don't have to remove the passphrase (which would leave your private key unprotected). Instead, load the key into ssh-agent once and it caches the unlocked key for the rest of your session:

ssh-add ~/.ssh/id_ed25519

You type the passphrase one time; every connection after that is silent. This guide covers ssh-agent on Linux/macOS/Windows, making it automatic, and the mobile equivalent.

Passphrase vs no passphrase

A passphrase encrypts your private key on disk, so a stolen laptop doesn't hand over your servers. That protection is worth keeping. The annoyance — typing it constantly — is solved by the agent, not by deleting the passphrase. So: keep the passphrase, use the agent.

Use ssh-agent (Linux/macOS)

# start the agent if it isn't running:
eval "$(ssh-agent -s)"

# add your key (type the passphrase once):
ssh-add ~/.ssh/id_ed25519

# list loaded keys:
ssh-add -l

On macOS, store the passphrase in the Keychain so it loads automatically after a reboot:

ssh-add --apple-use-keychain ~/.ssh/id_ed25519

And add to ~/.ssh/config so keys load on first use without thinking about it:

Host *
    AddKeysToAgent yes
    UseKeychain yes

On Windows

Enable the built-in OpenSSH agent service once, then add the key:

Get-Service ssh-agent | Set-Service -StartupType Automatic
Start-Service ssh-agent
ssh-add $env:USERPROFILE\.ssh\id_ed25519

The Windows agent persists across reboots, so you add the key once and forget it.

Changing or removing a passphrase

If you actually want to change it (or set one on a key that has none):

ssh-keygen -p -f ~/.ssh/id_ed25519

It asks for the old passphrase, then the new one (leave empty to remove). Removing it entirely is convenient but means anyone who copies the file owns your access — prefer the agent.

On a phone

Mobile clients don't expose ssh-agent — they handle the equivalent internally. In TermAI the key lives in the device Keychain, unlocked by the phone's own biometrics/passcode, so you're not retyping a passphrase per connection; the device's security is the agent. You get the security of an encrypted key with one-tap connections.

FAQ

How do I stop SSH asking for my passphrase every time?
Load the key into ssh-agent once with ssh-add ~/.ssh/id_ed25519; it caches the unlocked key for your session. Add AddKeysToAgent yes to ~/.ssh/config to make it automatic.

Should I remove the passphrase instead?
Better not — the passphrase encrypts your private key on disk. Use ssh-agent for convenience and keep the protection.

How do I make the passphrase stick after a reboot?
On macOS use ssh-add --apple-use-keychain and UseKeychain yes; on Windows set the ssh-agent service to start automatically. The key then loads on its own.

How do I change my key's passphrase?
Run ssh-keygen -p -f ~/.ssh/id_ed25519; it changes the passphrase without changing the key itself.

Quick Facts

• Don't remove the passphrase — it encrypts the key on disk; use the agent instead
• Cache it: ssh-add ~/.ssh/id_ed25519 (type passphrase once per session)
• Automatic: AddKeysToAgent yes in ~/.ssh/config; macOS Keychain / Windows agent persist it
• Change it: ssh-keygen -p -f ~/.ssh/key
• Mobile: the device Keychain + biometrics is the agent