I am using pass to manage my passwords. It uses my GPG key to encrypt.

My key recently expired and I created a new one.

pass will no longer create new passwords since my old key expired.

I can decrypt existing passwords. It uses the old ID 3D1B47D3 as when decrypting I see gpg: Note: secret key 3D1B47D3 expired at Sun 02 Jul 2017 16:36:45 BST.

3D1B47D3 is my old key id, 1F7CCC88 is my new key ID.

Therefore I need to re-encrypt ~/.password-store using my new key. The docs say using pass init 1F7CCC88 should do so.

However I get the error:

gpg: [stdin]: encryption failed: Unusable public key
gpg: Note: secret key 3D1B47D3 expired at Sun 02 Jul 2017 16:36:45 BST`. 

The error is repeated for every password.

~/.password-store/.gpg-id contains my new key ID since running init.

I can encrypt files manually using gpg --encrypt filename using my new key.

Note my keys and sub-keys all have an expire date in the future.

pub   4096R/1F7CCC88 2016-07-02 [expires: 2018-07-28]
uid                  Kris Leech <[email protected]>
sub   4096R/3D1B47D3 2016-07-02 [expires: 2018-07-28]
sub   2048R/E77481E9 2016-07-28 [expires: 2018-07-28]
  • Possible duplicate of gpg --encrypt fails
    – Yaron
    Aug 7, 2017 at 11:23
  • 1
    I looked at this question already, their issue was that they didn't change the expire for the sub-keys too. But as far as I can see this isn't my issue. I can encrypt/decrypt outside of pass using my new key.
    – Kris
    Aug 7, 2017 at 13:14

4 Answers 4


Looks like pass is using gpg2, you created the keys using gpg, and there is something not supported in gpg2 (md5 deprecated?).

e.g. decrypting with gpg works:

$ gpg -d --quiet secret.gpg 

You need a passphrase to unlock the secret key for
user: "bot three (third bot) <[email protected]>"
2048-bit RSA key, ID 2A8EA0F6, created 2017-08-24 (main key ID 2003591B)

something much longer then blah

and with gpg2 doesn't:

$ gpg2 -d --quiet secret.gpg 
gpg: decryption failed: No secret key

Renaming gpg2 forces pass to use gpg:

# mv /usr/bin/gpg2 /usr/bin/gpg2-css
$ pass show test/secret
something much longer then blah

What you can do is:

  1. Rename gpg2.
  2. Create a gpg2 key.
  3. Re-init the password store using the new gpg2 generated key to re-encrypt.
  4. Rename gpg2 back to gpg2.

Should work again at this point. From here, use gpg2, not gpg.



In addition to the answer I accepted I wanted to post another option. You can just import your existing key in to gpg2.

gpg --list-keys
gpg --export [ID] > public.key
gpg --export-secret-key [ID] > private.key
gpg2 --import public.key
gpg2 --import private.key
rm public.key private.key

I'm late to the party but I found a solution.

I must say that none of this solutions worked for me and I have multiple folders inside ~/.password-store with dozens of keys which means i can't avoid the folder issue.

What worked for me is:

$ cp -r ~/.password-store ~/.password-store.backup
$ cd ~/.password-store
$ pass init <new-gpg-key-hash>
Password store initialized for <new-gpg-key-hash>
folder1/pass1: reencrypting to <new-gpg-key-hash> 
gpg: Note: secret key <old-gpg-key-hash> expired at Tue XX Jul 2021 XX:YY:ZZ AM EDT
folder2/pass1: reencrypting to <new-gpg-key-hash> 
gpg: Note: secret key <old-gpg-key-hash> expired at Tue XX Jul 2021 XX:YY:ZZ AM EDT

You can verify it worked by copying a pass and generating a new pass (causing the can't verify authenticity of some other public key which turns out was strange side effect):

pass -c folder1/pass1
pass generate test/test

This did work. If something is wrong you can simply:

mv ~/.password-store.backup ~/.password-store

Hope it helps someone else! cheers


pass init *gpg-id* in an existing password-store directory will reencrypt the entire store to gpg-id.

Per pass manfiles:

If the specified gpg-id is different from the key used in any existing files, these files will be reencrypted to use the new id.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .