How to Stop SSH Asking for Your Key Passphrase at Every Login

SSH asks repeatedly because your encrypted private key is not loaded in the authentication agent available to the current shell. Start or reuse an agent, load the key once with ssh-add, and configure the client to add it automatically. On macOS, enable Keychain storage as well if you want the passphrase to survive logouts and reboots.

Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.

eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519
ssh-add -l

The key remains encrypted on disk. The agent holds the unlocked identity only for its lifetime, unless a desktop keychain or an explicit lifetime setting keeps it available longer.

#	Preview	Product	Price
1		Gaoye Blue Light Blocking Glasses	$9.99	Buy on Amazon
2		Windex Gaming Cleaning Wipes, Pre-Moistened Wipes to Instantly Clean all Gaming Gear and...	$6.59	Buy on Amazon
3		LISEN Cell Phone Stand Phone Holder for Desk, Office Decor Gadgets for Men	$9.99	Buy on Amazon
4		Ledagic IC+RGBW USB Powered Led Light Bar with App & Remote Control, 2 Pack	$9.99	Buy on Amazon
5		HUANUO FlowLift™ Dual Monitor Stand, Fully Adjustable Gaming Monitor Desk Mount for 13–32″...	$59.98	Buy on Amazon

As an Amazon Associate I earn from qualifying purchases.

Why SSH keeps requesting the passphrase

A private-key passphrase encrypts the key file at rest. SSH cannot use that key until the file is unlocked, so it asks for the passphrase when no usable copy is already held by an authentication agent.

ssh-agent is a background process that performs private-key operations on behalf of SSH. After you enter the passphrase once, ssh-add loads the key into that agent. Later connections use the agent through the Unix-domain socket named by SSH_AUTH_SOCK; they do not reopen the encrypted key file or ask again.

#1 Best Overall

Sale

Gaoye Blue Light Blocking Glasses

• BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
• EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
• COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
• LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
• WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.

$9.99

Buy on Amazon

This arrangement lasts only as long as the particular agent and its loaded identity. A new terminal may point to another agent, a logout may destroy the session agent, a reboot may clear it, and a lifetime limit can expire the identity. If SSH_AUTH_SOCK is empty or points to a stale socket, SSH has no route to the agent and prompts again.

The reliable one-time setup

Use these steps in a shell that will actually run your SSH commands. Replace the filename if your key is named differently.

1. Check whether an agent is already available

   Print the socket variable:

   printf '%sn' "$SSH_AUTH_SOCK"

   A non-empty value usually means the session already provides an agent. Do not start a second agent automatically if a desktop session has supplied one; using multiple agents is a common cause of keys appearing to vanish between terminals.

2. Start an agent only when necessary

   In a shell without an agent, start one and import its environment variables into the current shell:

   eval "$(ssh-agent -s)"

   The eval command applies the SSH_AUTH_SOCK and related values printed by ssh-agent. Starting an agent in one terminal does not automatically make it available to an unrelated terminal.

3. Load the actual private key

   Load the encrypted private key, not its public-key companion ending in .pub:

   ×

   Free tools Windows power users keep installed

   One-click scans. No signup required.

   Clean & speed up →Stop driver crashes →Fix Windows issues →
   Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

   ssh-add ~/.ssh/id_ed25519

   ssh-add asks for the passphrase at this point. A successful import makes the identity available to clients connected to this same agent.

4. Verify that the identity is present

   ssh-add -l

   The command lists fingerprints for loaded identities. If it reports no identities, the key was not loaded into the agent you are using.

   Rank #2

   

   Windex Gaming Cleaning Wipes, Pre-Moistened Wipes to Instantly Clean all Gaming Gear and Electronics, Resealable Packaging for a Freshness Lock, 25 count (Pack of 1)

   • WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
   • AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
   • PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
   • ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
   • COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed

   $6.59

   Buy on Amazon

5. Test a connection

   Connect to the destination normally. SSH should use the loaded identity without another passphrase prompt. If it still asks, continue with the host and socket checks below rather than loading the key repeatedly into random agents.

Make OpenSSH add the key automatically

OpenSSH supports the AddKeysToAgent client option. When enabled, a key used for authentication can be added, together with its passphrase, to a running agent. Put the setting in ~/.ssh/config:

Host *
    AddKeysToAgent yes
    IdentityFile ~/.ssh/id_ed25519

The first connection in a session may still ask for the passphrase if the key is not loaded. After that successful prompt, the key is available from the running agent for subsequent connections. Running ssh-add once during session setup gives you a predictable prompt before the first connection instead.

Use host-specific blocks when keys differ

A global Host * block is convenient only when the same identity is appropriate everywhere. For separate work, personal, or server keys, narrow the pattern and specify each path:

Host code.example.net
    AddKeysToAgent yes
    IdentityFile ~/.ssh/id_ed25519_work

Host server.example.net
    AddKeysToAgent yes
    IdentityFile ~/.ssh/id_ed25519_server

SSH applies the first value it obtains for many options, so put specific host blocks before a broad block that might set an unintended identity. The pattern must match the name you type, including aliases defined in the same file.

Set an agent lifetime when appropriate

OpenSSH can apply a time interval to keys added through AddKeysToAgent. A lifetime limit removes an identity automatically after the interval, reducing the period during which an unlocked key can be used. Choose a duration that matches the session’s risk and convenience requirements; a short-lived administrative session should not necessarily use an all-day identity.

When a key disappears after a predictable period, inspect the configuration for a lifetime value before assuming the agent is broken. An expired identity must be loaded again with ssh-add.

macOS: use the Keychain and agent together

Apple changed automatic agent loading in macOS 10.12.2. Apple Technical Note TN2449 documents two separate options: UseKeychain yes stores the key’s passphrase in the macOS Keychain, while AddKeysToAgent yes enables loading the key into ssh-agent.

Rank #3

Sale

LISEN Cell Phone Stand Phone Holder for Desk, Office Decor Gadgets for Men

• Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
• Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
• Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
• ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
• Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)

$9.99

Buy on Amazon

Add a matching block to ~/.ssh/config:

Host *
    AddKeysToAgent yes
    UseKeychain yes
    IdentityFile ~/.ssh/id_ed25519

Use a narrower host pattern and a different IdentityFile where hosts use different keys. Keychain storage is a macOS facility; it does not make the same configuration portable to every OpenSSH implementation.

Load an existing key into Keychain-backed macOS SSH

If the key has not yet been registered, run the Apple-supported form available in the installed macOS build:

ssh-add --apple-use-keychain ~/.ssh/id_ed25519

Enter the passphrase once. With UseKeychain yes, macOS can retrieve the stored secret when the key is needed, and AddKeysToAgent yes places the unlocked identity in the running agent.

Keep a shared config compatible with older clients

Older OpenSSH versions may not recognize UseKeychain. Apple documents placing IgnoreUnknown UseKeychain before the option so clients that do not know it ignore that line instead of failing configuration parsing:

Host *
    IgnoreUnknown UseKeychain
    AddKeysToAgent yes
    UseKeychain yes
    IdentityFile ~/.ssh/id_ed25519

Check the client version on the machine that will read the file:

ssh -V

Do not assume that a configuration copied from a newer Mac is accepted unchanged by an older OpenSSH installation.

Linux and other OpenSSH systems

Many Linux desktop environments start an agent or expose a session keyring automatically. Reuse that service: check SSH_AUTH_SOCK, inspect it with ssh-add -l, and load the key with ssh-add path/to/private_key once per agent lifetime.

If no desktop agent exists, start one in the login shell:

Rank #4

Ledagic IC+RGBW USB Powered Led Light Bar with App & Remote Control, 2 Pack

• Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
• Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
• 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
• Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
• USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC

$9.99

Buy on Amazon

eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519

Place the startup logic in the session mechanism that actually creates your shell, rather than blindly appending it to every shell startup file. Starting a fresh agent for every subshell creates several agents, each with a different socket and an incomplete key list. A login manager, terminal emulator, or session keyring may already be doing this work.

Graphical passphrase prompts

The SSH_ASKPASS and SSH_ASKPASS_REQUIRE environment variables control graphical prompting when no terminal is available. They determine how a prompt is displayed; they do not cache a private key and cannot replace an agent. If a headless job unexpectedly invokes a graphical helper, inspect these variables and the job’s environment, then decide whether a terminal prompt or a deliberately managed agent is appropriate.

Diagnose a prompt that will not go away

Work through the checks in order. Each one isolates a different failure mode.

1. Confirm the current shell’s agent socket

   printf '%sn' "$SSH_AUTH_SOCK"

   An empty value means the client cannot contact an agent. A value inherited from an old terminal can refer to a socket whose agent has exited. Open a clean session or start one agent and export its environment again.

2. List identities in that agent

   ssh-add -l

   If the list is empty, load the intended private key:

   ssh-add ~/.ssh/id_ed25519

   If fingerprints appear but the connection still prompts, the client may be selecting a different key or a different agent.

   ×Recommended: Update Every Outdated Driver on Your PC in One Scan - Free →Free scan · exact hardware matchRecommended: PC Feels Slow? A Free Scan Shows What's Dragging Windows Down →Free scan · Windows 10 & 11
   Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

3. Check which identity file the host configuration resolves

   ssh -G host.example | grep -i identityfile

   This prints the effective identity-file settings after SSH merges command-line options, host aliases, and configuration blocks. Compare the result with the key you loaded. A typo, an alias mismatch, or a broad block can make SSH ignore the loaded identity.

4. Verify that the host pattern matches

   Settings under Host server.example.net do not apply when you connect using a different alias or address unless that name is included in the pattern. Put every intended alias in the block, or use the exact host name shown by your command.

   Best Value

   Sale

   

   HUANUO FlowLift™ Dual Monitor Stand, Fully Adjustable Gaming Monitor Desk Mount for 13–32″ Computer Screens, Full Motion VESA 75x75/100x100 with C-Clamp & Grommet Base, Each Arm Holds 4.4 to 19.8 lbs

   • Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
   • Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
   • Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
   • Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
   • Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.

   $59.98

   Buy on Amazon

5. Look for an agent lifetime limit

   Keys added with a configured interval are removed automatically when they expire. Reload the identity and inspect ~/.ssh/config for a lifetime setting if the prompt returns at a regular time.

6. Reset stale or competing agents

   Several agents can be running at once, especially after repeatedly executing ssh-agent in shell startup files. Remove stale socket exports, start a clean session agent, and load the key there. To clear every identity from the agent selected by the current shell:

   ×Drivers · Free Tool

   Crashes, No Sound, or Screen Glitches?

   Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.

   Find the Right Drivers →Free scan · under a minute

   Clean & speed up →Update all drivers →
   Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

   ssh-add -D

   Then add only the identities needed for that session. This command removes keys from the agent; it does not delete private-key files.

7. Check the selected key itself

   Make sure IdentityFile names the private file and that the file is readable by the account making the connection. Loading a public key, a missing path, or a key belonging to another account cannot satisfy authentication for the intended identity.

What persists, and for how long?

The phrase “remember my passphrase” can describe several different persistence models. They have different security consequences.

Agent caching is usually the middle ground: the disk copy stays encrypted, while authorized local processes can use the loaded identity. Protect the account, the agent socket, and the machine on which the agent runs.

Why removing the passphrase is usually the wrong fix

Deleting a passphrase stops the prompt by making the private-key file immediately usable. It also means that anyone who obtains the file, a backup, or a copied home directory can attempt authentication without overcoming another secret. The convenience is real, but so is the expanded impact of theft.

Use an agent, a desktop keychain, or a hardware-backed identity instead when the goal is fewer prompts rather than an unencrypted key. On shared, portable, or administratively sensitive machines, set a finite agent lifetime and avoid loading keys that are not needed for the task.

When a hardware-backed identity makes sense

OpenSSH supports security-key-hosted identity types including [email protected] and [email protected]. A FIDO device keeps the signing operation on the token and can require a PIN or physical touch. That is a change in authentication design, not a repair for a misconfigured existing encrypted file.

Choose this route when the threat model justifies hardware possession and you can provide enrollment, backup, and account-recovery procedures. If the only problem is a prompt on every login, fix the agent socket, key loading, and host configuration first.

Quick Recap

SaleBestseller No. 1

Gaoye Blue Light Blocking Glasses

$9.99

Bestseller No. 2

Windex Gaming Cleaning Wipes, Pre-Moistened Wipes to Instantly Clean all Gaming Gear and Electronics, Resealable Packaging for a Freshness Lock, 25 count (Pack of 1)

$6.59

SaleBestseller No. 3

LISEN Cell Phone Stand Phone Holder for Desk, Office Decor Gadgets for Men

$9.99

Bestseller No. 4

Ledagic IC+RGBW USB Powered Led Light Bar with App & Remote Control, 2 Pack

$9.99

SaleBestseller No. 5

HUANUO FlowLift™ Dual Monitor Stand, Fully Adjustable Gaming Monitor Desk Mount for 13–32″ Computer Screens, Full Motion VESA 75x75/100x100 with C-Clamp & Grommet Base, Each Arm Holds 4.4 to 19.8 lbs

$59.98

A repeatable setup checklist

• Identify the private key that the destination should use.
• Confirm whether the current session already provides an agent by printing SSH_AUTH_SOCK.
• Start one agent only if the socket is missing.
• Load the private key with ssh-add and verify it with ssh-add -l.
• Set AddKeysToAgent yes in the host block that actually matches the destination.
• On macOS, add UseKeychain yes and register the key with ssh-add --apple-use-keychain when supported.
• Use ssh -G host.example to confirm the effective IdentityFile.
• Investigate lifetime expiry or competing agents before creating another one.
• Keep the private key encrypted unless your threat model explicitly accepts an unencrypted file.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.