How to change a key's passphrase — and the file permissions SSH demands

The passphrase needs rotating, or SSH refuses to use your key at all.

Every flag and config keyword was checked against the OpenSSH 9.6 man pages, and the config examples were parsed for real with ssh -G.

ssh-keygen -p -f ~/.ssh/id_ed25519   # asks for the old passphrase, then the new one twice
chmod 700 ~/.ssh
chmod 600 ~/.ssh/id_ed25519            # ssh REFUSES to use a private key others can read
chmod 644 ~/.ssh/id_ed25519.pub
ssh-keygen -l -f ~/.ssh/id_ed25519.pub # print the fingerprint — compare before you trust

Good to know

SSH refuses a private key that others can read: ~/.ssh is 700, the private key 600, the public key 644. ssh-keygen -l prints the fingerprint — compare it before you trust a key.

SSH Cheatsheet one-page card — commands that actually work — The full one-page card — SSH Cheatsheet. Get the complete cheatsheet on GitHub