# Remove or change a private key passphrase

To remove a passphrase from a private key, run `openssl pkey -in encrypted.key -out plain.key` and enter the current passphrase when prompted. To add one, run `openssl pkey -in plain.key -aes256 -out encrypted.key`. Web servers generally need the unencrypted form, because they cannot answer a passphrase prompt during an unattended restart — protect the key with `chmod 600` instead. `openssl pkey` works for RSA, EC and Ed25519 keys alike, unlike the older `openssl rsa`.

Source: https://certguru.io/openssl/remove-passphrase-from-key/
Last updated: 2026-08-19
Commands verified against OpenSSL 3.5.7.

---

## Remove a passphrase

*Write an unencrypted copy*

```bash
openssl pkey -in encrypted.key -out plain.key
```

OpenSSL prompts for the current passphrase. Then lock the result down immediately:

```bash
chmod 600 plain.key
```

> **The new file has no protection but permissions**
>
> Anyone who can read `plain.key` can use it. Make sure it is not in a directory that gets backed
>   up to somewhere less careful, synced to a shared drive, or included in a container image layer.

## Add a passphrase

*Encrypt with AES-256*

```bash
openssl pkey -in plain.key -aes256 -out encrypted.key
```

## Change an existing passphrase

There is no direct "change" operation — decrypt and re-encrypt in one pipeline:

```bash
openssl pkey -in encrypted.key -aes256 -out new-encrypted.key
```

You are prompted for the old passphrase to read the file and the new one to write it.

## Non-interactive

*Remove a passphrase in a script*

```bash
openssl pkey -in encrypted.key -passin file:/run/secrets/key-passphrase -out plain.key
```

*Add one, reading from the environment*

```bash
openssl pkey -in plain.key -aes256 -passout env:KEY_PASSPHRASE -out encrypted.key
```

> **Avoid pass: in anything real**
>
> `-passin pass:secret` puts the passphrase into `ps` output and your shell history. `file:` and
>   `env:` both avoid the process list; `file:` is the better of the two on a shared host.

## When to keep the passphrase

| Key | Passphrase? | Why |
| --- | --- | --- |
| Web server TLS key | No | The server must restart without a human present |
| CA private key | **Yes** | Handled by a person, and catastrophic if leaked |
| Key on a laptop or workstation | Yes | Disk theft is a realistic risk |
| Key in a secrets manager | No | The manager provides the protection |
| Key in a container image | Neither — do not do this | Images are copied and shared far more than people expect |

## nginx with an encrypted key

If you must keep the passphrase, nginx can read it from a file:

```nginx
ssl_certificate      /etc/ssl/certs/fullchain.crt;
ssl_certificate_key  /etc/ssl/private/encrypted.key;
ssl_password_file    /etc/ssl/private/key-passphrase;
```

> **This buys less than it looks like**
>
> The passphrase now sits in plaintext next to the key it protects. Anyone who can read one can
>   almost certainly read the other. It solves the unattended-restart problem, not a security one.

## The older subcommands

`openssl rsa` does the same for RSA keys and is what most older documentation shows:

```bash
openssl rsa -in encrypted.key -out plain.key
```

> **It changes the format on OpenSSL 3**
>
> `openssl rsa` writes PKCS#8 by default on OpenSSL 3.x, where it wrote PKCS#1 on 1.x. If something
>   downstream expects `BEGIN RSA PRIVATE KEY`, add `-traditional`. See
>   [PKCS#8 to PKCS#1](/convert/pkcs8-to-pkcs1/). `openssl pkey` avoids the question by working
>   uniformly for every key type.

## Confirm nothing changed but the encryption

*Same key, so the public keys must match*

```bash
openssl pkey -in encrypted.key -pubout | openssl sha256
openssl pkey -in plain.key -pubout | openssl sha256
```


## Frequently asked questions

### Is it safe to remove the passphrase?

It is a trade-off rather than a mistake. Removing it means file permissions are the only protection, which is what nearly every production web server does — because the alternative is a service that cannot restart without a human present. Keep passphrases on keys people handle, such as a CA key.

### How do I know if my key has a passphrase?

Read the first line. `BEGIN ENCRYPTED PRIVATE KEY` is PKCS#8 encryption. An older key may say `BEGIN RSA PRIVATE KEY` with a `Proc-Type: 4,ENCRYPTED` line beneath it. `BEGIN PRIVATE KEY` alone means unencrypted.

### I have forgotten the passphrase — can I recover the key?

No. The key material is encrypted with a key derived from the passphrase and there is no bypass. Generate a new key and have the certificate reissued.

### Can nginx use an encrypted key?

Yes, with `ssl_password_file` pointing at a file containing the passphrase. That stores the passphrase in plaintext next to the key, so the security gain is close to zero — but it does let a restart proceed unattended.


## References

- [openssl-pkey(1)](https://docs.openssl.org/3.5/man1/openssl-pkey/) — reading an encrypted key and writing it back unencrypted
- [RFC 5958: asymmetric key packages](https://www.rfc-editor.org/rfc/rfc5958) — PKCS#8, the self-describing private key container

## Related pages

- https://certguru.io/formats/key/
- https://certguru.io/openssl/generate-private-key/
- https://certguru.io/errors/bad-decrypt/
- https://certguru.io/formats/pkcs8/
- https://certguru.io/platforms/nginx/
- https://certguru.io/openssl/check-key-matches-certificate/

--
CertGuru — https://certguru.io