I recently got GPG setup on my Mac:

brew install gpg;
brew install gpg-agent;

And generated a key pair with a passphrase.

I added use-agent to my ~/.gnupg/gpg.conf and allow-preset-passphrase to ~/.gnupg/gpg-agent.conf

I successfully decrypted a file using:

gpg --use-agent --output example.txt --decrypt example.gpg

which prompted me to enter my private key passphrase. The trouble is, when decrypting subsequent files, gpg-agent again prompts me for this passphrase.

Currently, my passphrase is a really long string which is near impossible to type each time. I would like gpg to behave like ssh-agent wherein the passphrase is stored securely and remembered forever (even between sessions).

I understand that this might decrease security if my laptop was comprised, but this inconvenience would probably deter me from using gpg all together.

I'm not sure if:

default-cache-ttl 31536000
max-cache-ttl 31536000

are the options I'm looking for to store between reboots There's sadly no man entry for gpg-agent.

How can I make gpg/gpg-agent remember my private key passphrase forever?

  • The value for those options is in seconds, the default being 600. And, yes, they are the droids you are looking for... – jasonwryan Aug 14 '16 at 6:27
  • I think you want max-cache-ttl insteal of ...-tcl, and then only for GnuPG 2.1 and later, before that use maximum-cache-ttl – Anthon Aug 14 '16 at 8:03

You probably don't have the environment variable $GPG_AGENT_INFO set.

What you can do as a temporary measure is run gpg-agent bash (or the shell of your choice) and retry decryption.

On the long run this might just be solved by first logging out and then log back in to your system, then check echo $GPG_AGENT_INFO again. If it is there chances are good that you no longer have to retype your passphrase every time.

Most Linux distributions have hooks for this in place and I expect OSX to be as user friendly, the requirement, of course being that gpg/gpg-agent is available (installed) before starting your session.

  • 1
    OSX is user friendly. I installed GnuPG from gpgtools.org and it saves my passphrases to the Apple Keychain if desired. – Deathgrip Jun 28 '17 at 21:35

You should start the agent like this.

eval $(gpg-agent --daemon --write-env-file "${HOME}/.gnupg/.gpg-agent-info)"

Then in your .bashrc file add the lines:

if [ -f "${HOME}/.gnupg/.gpg-agent-info" ]; then
    . "${HOME}/.gnupg/.gpg-agent-info"
    export GPG_AGENT_INFO
  • WARNING: "--write-env-file" is an obsolete option - it has no effect – MaXi32 Aug 19 '20 at 16:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.