I've changed a passphrase for a secret key:

$ gpg --edit-key <PUBKEY_ID>

Reloaded using gpgconf --reload, however the old password still is in use when trying to decrypt.

$ gpg2 -d somefile.gpg where this file is encrypted with a public subkey of the one I changed the passphrase of. It prompts me for the passphrase and only accepts <old_passphrase>.

However, when I run $ gpg --edit-key <PUBKEY_ID> and passwd again, it does require me to use <new_passphrase> to unlock the key.

What is going wrong here?

Running KDE Neon 5.8 (Ubuntu 16.04 Xenial based)

$ gpgconf --list-components
gpg:GPG for OpenPGP:/usr/bin/gpg2
gpg-agent:GPG Agent:/usr/bin/gpg-agent
scdaemon:Smartcard Daemon:/usr/lib/gnupg2/scdaemon
gpgsm:GPG for S/MIME:/usr/bin/gpgsm
dirmngr:Key Acquirer:/usr/bin/dirmngr
pinentry:PIN and Passphrase Entry:/usr/bin/pinentry

1 Answer 1


Notice that the command that you use to change the password (in your question) is gpg while the command that you use to decrypt is gpg2.

These two commands belong to two separate installations of GnuPG. One is probably GnuPG 1.4.x (or at least older than 2.1) and the other may be GnuPG 2.1.x. These two versions of GnuPG manages the keys in separate ways.

To change the password for gpg2, use gpg2 --edit-key (rather than gpg --edit-key)

From "What’s new in GnuPG 2.1":

To ease the migration to the no-secring method, gpg detects the presence of a secring.gpg and converts the keys on-the-fly to the the key store of gpg-agent (this is the private-keys-v1.d directory below the GnuPG home directory (~/.gnupg)). This is done only once and an existing secring.gpg is then not anymore touched by gpg. This allows co-existence of older GnuPG versions with GnuPG 2.1. However, any change to the private keys using the new gpg will not show up when using pre-2.1 versions of GnuPG and vice versa.

(Note that gpg in the text above refers to the gpg2 executable of GnuPG 2.1)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .