42

I want to remove the passphrase from gpg key after creating it. Why? . Because the tigase-kontalk documentation says so and I want to compile and setup my own version of this server . But am stuck at this point

Create GPG key Create a GPG key for both signing and encrypting, and remove its passphrase after creating it

I want a linux gpg command to remove the passphrase or to export unprotected keys.

Improve this question
1

5 Answers 5

Reset to default
54

Here is a more complete answer based on Justin's:

(Using gpg 1.4.16 on Ubuntu 14)

  • Get the ID of your key like this:
gpg --list-secret-keys --keyid-format=long

This will output a few lines similar to below. The key ID is the value XXXX

/home/username/.gnupg/secring.gpg
----------------------------------
sec   4096R/XXXX <creation date>
uid                  name <email.address>
ssb   4096R/YYYY <creation date>

  • Open the gpg key edit submenu like this:

    gpg --edit-key XXXX

    You will see information about the key.

  • Type passwd at the prompt to change the password:

    gpg> passwd

  • Enter your existing passphrase.

  • Enter the new passphrase for this secret key. (Leave this blank and press Enter)

  • Press Enter twice and consider the warnings from the tool and its implications before proceeding.

    You don't want a passphrase - this is probably a *bad* idea!

    Do you really want to do this? (y/N) y

Similarly On Debian 11:

enter image description here

enter image description here

enter image description here

Improve this answer
4
  • 1
    This doesn't work for me : Debian 11 ARM64 inside Qemu
    – Ekaterina Ivanova iceja.net
    Commented Oct 25, 2022 at 11:06
  • I had to use gpg --list-secret-keys --keyid-format=long to get the XXXX key
    – Sr.PEDRO
    Commented Sep 11, 2023 at 13:49
  • @Sr.PEDRO You don't have to use the shortened XXXX value after the /. The full key ID on the next line works too.
    – Frak
    Commented Sep 12, 2023 at 14:40
  • @EkaterinaIvanovaiceja.net I was able to get it to work on my Debian 11 instance. imgur.com/a/sGBFFel
    – Frak
    Commented Sep 12, 2023 at 14:45
25

Let me share what I found. I thought I might share in case there is another lost soul In the bash shell,

gpg2 --batch --gen-key <<EOF
%no-protection
Key-Type:1
Key-Length:2048
Subkey-Type:1
Subkey-Length:2048
Name-Real: My super name
Name-Email: [email protected]
Expire-Date:0
EOF

The key can now be exported

gpg2 --export-secret-key fingerprinthere > private-key.key
gpg2 --export fingerprintshuld_be_put_here > public-key.key
Improve this answer
4
  • 2
    The trick is %no-protection
    – Dr Deo
    Commented Sep 22, 2018 at 22:30
  • 3
    Your question was how to "remove" a passphrase on a key after creating it. This answer, however, is for how to create it without a passphrase to start with.
    – Frak
    Commented Oct 1, 2019 at 19:38
  • This answer doesn't answer the original question. The OP already has a passphrase-protected secret key in their keyring, and they want to remove the protection.
    – pts
    Commented Apr 27, 2020 at 21:06
  • 1
    with gpg 2.2.27 this was the only solution that worked to generate keys for an automated environment
    – Stuart Cardall
    Commented Sep 18, 2021 at 22:59
9

It's simple. Just run:

gpg --edit-key <yourkeyhere>
passwd

When GnuPG prompts for the new passphrase, just leave it blank and hit enter.

Source: https://lists.gnupg.org/pipermail/gnupg-users/2003-April/017623.html

Improve this answer
5
  • 15
    This doesn't work. It returns error gpg: key key B64F361BF49F2E74/B64F361BF49F2E74: error changing passphrase: No passphrase given
    – Dr Deo
    Commented Sep 21, 2018 at 19:21
  • 1
    It worked for me (Ubuntu 16.04, GPG 1.4.20). At the end you need to save the key with save
    – user1182474
    Commented Jan 25, 2019 at 16:17
  • It doesn't work for me either.
    – Sedat Kapanoglu
    Commented Aug 31, 2019 at 4:08
  • 1
    This doesn't work on gpg 1.4.16. It lists some information about the key and puts you into a gpg submenu.
    – Frak
    Commented Oct 1, 2019 at 19:39
  • This works with GPG 1.4 (I've just tried it with 1.4.16). It also works with GPG 2.1.18. I suspect it was broken in earlier GPG 2.0--2.1.x.
    – pts
    Commented Apr 27, 2020 at 18:55
4

See https://unix.stackexchange.com/a/597949/20960. It seems that some varieties of pinentry refuse to accept an empty passphrase, while others are fine with it.

gpg --pinentry-mode loopback --passwd KEY

Improve this answer
2
  • With gpg 2.2.40 on Debian (Trixie) this does not work anymore, neither with --edit-key and passwd, nor with --passwd. It seems GnuPG intentionally removed all options to export an unencrypted secret key.
    – MichaIng
    Commented Sep 17, 2023 at 18:44
  • like Michal, this used to work and now it doesn't. However --edit-key worked for me, by entering an empty and saying yes twice. unix.stackexchange.com/a/550538/606003
    – Ljupcho Naumov
    Commented Mar 19 at 20:11
0

Very simple: When generating the GPG key pairs it will ask for password, do not enter any password. Just press okay.

Command to generate the key pairs:

gpg --full-generate-key
Improve this answer
1
  • Reread the question, they want to remove an existing passphrase.
    – Toto
    Commented Jul 8 at 10:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .