Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsA public key does not have a password. When a key prompt asks for a password, it is almost always asking for a passphrase that unlocks the private key material stored on your device. The public key is meant to be shared, and the passphrase is a separate secret layered on top of the private key.
What the public and private keys each do
A public key and a private key are a mathematically linked pair, but they play different roles. The public key is designed to be shared. The private key is kept secret. Publishing the public key does not reveal the private key under the security assumptions of the scheme in use.
As an Amazon Associate I earn from qualifying purchases.
| Aspect | Public key | Private key |
|---|---|---|
| Intended handling | Shared openly with others | Kept secret by its owner |
| Encryption flow | A sender uses the recipient’s public key to protect a one-time session key | The recipient uses the matching private key to recover that session key |
| Signatures and authentication | Used to check operations made with the matching private key | Used to perform the private operation; exact behavior depends on the scheme and protocol |
| Can carry a password? | No. A public key is not a password-protected credential | Its stored form can be protected by a passphrase |
In OpenPGP, a public certificate can contain more than the bare public key, including identities and certifications. The OpenPGP developer documentation on managing private key material separates that public certificate from the private key material associated with it, and it is the private material that may be passphrase-protected. The OpenPGP specification in RFC 9580 describes the encryption functions that use these keys.
Recommended Free Tools
What the passphrase protects
The passphrase is a separate secret. It encrypts private key data while that data is stored, so the file is not usable by anyone who copies it without the passphrase. The passphrase is not the private key itself, and it is not a substitute for it.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
In OpenPGP
OpenPGP derives a symmetric key from the passphrase and uses that key to protect the private key material. When the passphrase is entered, the derived key decrypts the material for use. Once unlocked, the private material may remain temporarily available in memory, which is a normal part of how the software works and a reason to lock or close sessions on shared machines.
RFC 9580 says that an implementation producing a passphrase-protected secret-key packet must use a String-to-Key (S2K) specifier. It recommends Argon2. Where Argon2 is unavailable, iterated-and-salted S2K may be used, but only with a strong passphrase and a sufficiently high work factor.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
OpenPGP protection can also be applied per component key. Different component keys inside the same certificate may have different protection, and some may be left unprotected.
In SSH
GitHub’s documentation on SSH passphrases explains the core rationale: a passphrase adds protection if someone gains access to your computer. The GitHub Docs page states: “To add an extra layer of security, you can add a passphrase to your SSH key.” The same guide explains that ssh-agent can cache an unlocked key, so you do not have to enter the passphrase for every connection. It also states that you can change the passphrase for an existing key without regenerating the key pair. See GitHub Docs: Working with SSH key passphrases.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Passphrases are optional
A passphrase is not always required. OpenPGP permits unprotected private key material. SSH documentation presents the passphrase as an additional protection layer rather than a fixed requirement. Whether an unprotected key is acceptable depends on the software, where the file is stored, its file permissions, whether an agent is running, whether hardware is involved, and your threat model.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Which password is the prompt asking for?
Because several different credentials can produce a prompt, identify the source before you enter anything. The prompt usually names the file or tool involved.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- An SSH key passphrase prompt appears when a private key file is encrypted and is being used to connect. It unlocks that local key file.
- An
ssh-agentprompt appears when the agent needs to load the key. Once unlocked, the agent can supply the key for later connections without asking again. - An OpenPGP passphrase prompt appears when software needs the secret key material to decrypt data or sign something.
- A service account password is used to log in to a website or server account. It is a different credential, even when the same service also uses keys.
- A hardware-token PIN unlocks a physical security device. It is separate from any passphrase on a key file.
When you troubleshoot, ask which software, file, or operation produced the prompt. Entering an account password where a key passphrase is expected will fail, and a passphrase is not a reset mechanism for an account.
Quick Recap
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Common misunderstandings
- “My public key has a password.” It does not. Only the private key material may be protected by a passphrase.
- “The passphrase is my private key.” It is a secret used to protect or unlock the stored private key. Losing the private key cannot be fixed by remembering the passphrase, and vice versa.
- “Adding a passphrase means the key cannot be misused.” A passphrase protects stored key material. Once a key is unlocked, or an agent holds it, the protection is no longer in the way.
Practical takeaways
- Share the public key; keep the private key file and its passphrase protected.
- Use a strong, unique passphrase where the software supports it, especially for keys stored on laptops or shared machines.
- Use an agent to avoid repeated prompts, and lock or remove unlocked keys when you leave a machine.
- If you need to change the passphrase, check whether your tool supports changing it for an existing key. The GitHub guide describes this for SSH keys.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
