SSH asks for a key passphrase repeatedly when the private key is encrypted but no usable ssh-agent identity is available to the client. The durable fix is to run one agent per login session, load the private key into it with ssh-add, and configure OpenSSH to add the key automatically. On macOS, you can also store the passphrase in Keychain so the key can be restored after a restart. The private key remains encrypted on disk; only the agent holds the unlocked identity while it is running.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What the prompt means
An SSH key normally consists of a public key that you install on a server and a private key that stays on your computer. A passphrase encrypts the private-key file at rest. When SSH needs to authenticate, it must use the private key, so it asks for that passphrase if the key has not already been unlocked.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
An authentication agent changes the workflow. ssh-agent is a background process that accepts an unlocked private key through its Unix-domain socket. Later SSH connections ask the agent to sign the login challenge instead of reading and decrypting the key file again. The passphrase is therefore entered once for the lifetime of that agent, rather than once per connection.
The agent does not automatically survive every reboot, terminal, remote session, or desktop login. If the current shell points to a different agent, or if the agent has no loaded identity, SSH has no cached key to use and prompts again. The environment variable SSH_AUTH_SOCK tells SSH and ssh-add which agent socket to use.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
One-time setup in any OpenSSH shell
First determine whether your current session already has an agent. A desktop environment, terminal application, or operating-system keyring may have started one for you. If no usable agent is available, start one and export its environment variables into the current shell.
- Start an agent when your session does not already provide one:
eval "$(ssh-agent -s)" - Load the private key that the server expects. Adjust the filename if you use another key type or location:
ssh-add ~/.ssh/id_ed25519Enter the passphrase when prompted. This is the point at which the encrypted key is unlocked for the agent.
- Verify that an identity is loaded:
ssh-add -lThe command prints fingerprints for loaded keys. If it reports that no identities are available, the key was not loaded into the agent used by this shell.
- Connect normally:
ssh [email protected]Subsequent connections that select this identity should use the agent without another passphrase prompt.
The identity lasts only as long as the agent keeps it. Closing the agent, ending a session that owns it, reaching a configured lifetime, or restarting the computer can require another ssh-add.
Make OpenSSH load the key automatically
OpenSSH’s AddKeysToAgent client option tells the client to add a key and its passphrase to a running agent when the key is used. Put the setting in ~/.ssh/config:
Host *
AddKeysToAgent yes
IdentityFile ~/.ssh/id_ed25519With this configuration, the first connection that needs id_ed25519 asks for its passphrase and places the unlocked key in the agent. Later connections reuse it. The option does not create an agent by itself; a usable agent and SSH_AUTH_SOCK are still required.
A wildcard Host * applies the identity to every destination. If you use separate keys for work, personal systems, or different accounts, narrower host blocks are safer and prevent OpenSSH from trying an unintended key:
Host git.example.com
AddKeysToAgent yes
IdentityFile ~/.ssh/id_ed25519_work
Host server.example.net
AddKeysToAgent yes
IdentityFile ~/.ssh/id_ed25519_serverUse the actual destination name you type in the SSH command. Aliases in the configuration are also valid, but the matching Host pattern must cover that alias.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
macOS: persist the passphrase with Keychain
Apple changed automatic agent loading in macOS 10.12.2. Its documented configuration uses UseKeychain yes to store the key passphrase in the macOS Keychain and AddKeysToAgent yes to load the key into ssh-agent. Add a matching block to ~/.ssh/config:
Host *
AddKeysToAgent yes
UseKeychain yes
IdentityFile ~/.ssh/id_ed25519On the first use, macOS can retrieve the saved passphrase from Keychain and add the key to the running agent. This is the option that addresses prompts returning after a logout or reboot; AddKeysToAgent alone only helps while an agent still has the identity.
Load an existing key into the macOS agent
If the key is not present after changing the configuration, load it explicitly with the Apple-supported keychain option available in your installed macOS build:
ssh-add --apple-use-keychain ~/.ssh/id_ed25519Enter the passphrase once. Then check the loaded fingerprints with ssh-add -l. Option names have varied across OpenSSH builds shipped with macOS, so verify support on the machine you are configuring with:
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →ssh -VIf you maintain one configuration file shared with older OpenSSH versions that do not recognize UseKeychain, place this compatibility line before the option:
Host *
IgnoreUnknown UseKeychain
AddKeysToAgent yes
UseKeychain yes
IdentityFile ~/.ssh/id_ed25519Use a narrower host block and a different IdentityFile when only selected destinations should use the stored passphrase.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Linux and other OpenSSH systems
Many Linux desktop sessions provide an agent through a session keyring or desktop component. Prefer that existing agent instead of starting a second one. In a minimal window manager, text-only login, container, or manually managed shell, start an agent with eval "$(ssh-agent -s)" and then run ssh-add.
Check whether your shell can reach the agent
printf '%sn' "$SSH_AUTH_SOCK"A non-empty value should name a Unix socket. An empty value means the shell has no agent endpoint. A value inherited from another login can point to a socket that no longer exists or belongs to a different user session.
Free tools Windows power users keep installed
One-click scans. No signup required.
Load and manage identities
ssh-add ~/.ssh/id_ed25519
ssh-add -lTo clear every identity from the currently selected agent and start over, use:
ssh-add -DThat command removes keys from the agent; it does not delete or modify private-key files.
Why it still asks after you configured an agent
The shell is using the wrong agent
Multiple agents are common after opening a new terminal, entering a container, reconnecting over SSH, or restoring a desktop session. Compare SSH_AUTH_SOCK in the shell where you ran ssh-add with the shell where you run ssh. If they differ, load the key into the agent selected by the current shell or remove stale environment exports and start a clean session.
The key was never loaded
Run ssh-add -l. If the fingerprint is absent, load the actual private-key file with ssh-add path/to/private_key. Do not load the public .pub file; the agent needs the private key.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
The host block does not match
OpenSSH may be using a different identity than the one you configured. Ask the client to print its effective configuration for a destination:
ssh -G host.example | grep -i identityfileConfirm that the resulting path is the encrypted private key you intended and that the Host pattern containing AddKeysToAgent applies to that destination. A block for server.example.com does not match an alias such as prod unless the alias is also listed.
The key has expired from the agent
AddKeysToAgent can specify a lifetime interval. When that interval ends, OpenSSH removes the identity automatically. If your configuration or desktop policy sets a lifetime, expect one more passphrase entry after expiry. Remove the lifetime restriction only if that persistence fits your security requirements.
The agent socket is inaccessible
The socket path can exist while permissions, user identity, or a terminated agent prevent access. Check the value of SSH_AUTH_SOCK, make sure the socket belongs to your current user, and start a fresh agent if the process behind it is gone.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →A graphical prompt appears instead of a terminal prompt
SSH_ASKPASS and SSH_ASKPASS_REQUIRE control graphical passphrase prompting when no terminal is available. They do not cache a key and cannot replace an agent. Fix the agent connection and load the key; changing these variables only changes how a missing passphrase is requested.
A practical diagnostic sequence
Run these checks in order in the same shell from which the failing SSH command is launched:
- Print the selected agent socket:
printf '%sn' "$SSH_AUTH_SOCK" - List identities in that agent:
ssh-add -l - Print the identity files that OpenSSH will consider for the destination:
ssh -G host.example | grep -i identityfile - If the list is empty or the wrong key is shown, load the intended private key:
ssh-add ~/.ssh/id_ed25519 - Retry the connection. If it prompts only once and then works, the issue was a missing identity. If it prompts every time, compare the socket and agent between attempts, then inspect host matching and lifetime settings.
Security trade-offs of each approach
Stopping repeated prompts is a convenience decision, but it changes how long an unlocked identity remains usable. Compare the choices before applying a broad configuration.
| Approach | Private key encrypted at rest | When the passphrase is entered | Persistence | Main exposure |
|---|---|---|---|---|
Manual ssh-add |
Yes | Once per agent lifetime | Until the agent exits or the key lifetime expires | Processes that can access the agent socket may request signatures |
AddKeysToAgent yes |
Yes | On first use by a matching host | Until the running agent exits or the configured lifetime expires | A broad Host * block can load more keys or destinations than intended |
macOS UseKeychain yes plus AddKeysToAgent yes |
Yes | Normally once when the key is first registered; Keychain can supply it later | Keychain stores the passphrase; each running agent still has its own lifetime | Anyone who can unlock the macOS account and access the keychain may obtain the convenience |
| Removing the key passphrase | No | Never | Anyone with the readable private-key file can try to use it | Loss or theft of the file immediately removes the passphrase barrier |
FIDO security-key identity such as [email protected] |
Private material is held by hardware | May require a PIN and/or touch | Depends on the hardware and agent workflow | Requires carrying and protecting the security key; it is a different authentication design |
Agent caching keeps the private-key file encrypted on disk, but the unlocked identity is available to software that can use the agent socket. Protect your account, avoid sharing an agent socket with untrusted users or containers, and use host-specific configuration where practical. Do not remove a passphrase solely to eliminate prompts unless your machine’s threat model accepts an unencrypted key file.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesChoosing the right configuration
You use one personal computer and one key
Use a running desktop agent, set AddKeysToAgent yes, and specify the exact key with IdentityFile. On macOS, add UseKeychain yes if you want the passphrase restored after restarting the computer.
You use several keys for different services
Create separate host blocks, each with its own IdentityFile. This avoids accidental key offers and makes it clear which key should be cached. Keep the patterns as narrow as the destinations require.
You work in short-lived shells, containers, or jump hosts
Expect to initialize an agent for each isolated environment, or deliberately forward an existing agent only when the intermediary is trusted. A new shell with no inherited SSH_AUTH_SOCK cannot see identities loaded into an agent elsewhere.
You need automatic expiration
Configure an agent or AddKeysToAgent lifetime so identities disappear after a defined interval. This reduces the window in which a stolen session can use the cached key, at the cost of another passphrase prompt when the interval ends.
Recommended Free Tools
Quick Recap
What not to change
- Do not replace a private-key path with its
.pubfile; authentication signatures require the private key or an agent holding it. - Do not assume
SSH_ASKPASSsolves repeated prompts; it controls prompt delivery, not key storage. - Do not add every key to a global agent without checking which programs and sessions can reach its socket.
- Do not delete the passphrase from a valuable key merely because an agent was not configured correctly.
- Do not copy a macOS-only
UseKeychainsetting into an older or non-Apple OpenSSH client without checking option support; usessh -VandIgnoreUnknown UseKeychainwhere a shared file requires compatibility.
After the fix: a quick verification checklist
SSH_AUTH_SOCKis non-empty in the shell that runs SSH.ssh-add -lshows the expected fingerprint.ssh -G destinationshows the intendedIdentityFile.- The matching
Hostblock includesAddKeysToAgent yes. - On macOS,
UseKeychain yesis present only where supported and the key was registered with the Apple keychain option when needed. - A configured lifetime has not expired.
- The private key still has its passphrase and remains protected on disk.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
