I encrypted one file with gpg -c <file> and closed the terminal. After a while, I tried to decrypt it with gpg <file> and it decrypted it, without asking for a password. Is that normal? How to guarantee that gpg will ask for a password, even in my same computer?

  • How long was it since you last entered you GnuPG password at that point? The gpg-agent caches it for 10 minutes by default (GnuPG 2.2). – Kusalananda Oct 3 '17 at 15:37
  • Was gpg-agent running? If so it would have cached the credentials (just tested this on my Mac with gpg-agent in memory). – Petro Oct 3 '17 at 15:49

This is normal, gpg now uses gpg-agent to manage private keys, and the agent caches keys for a certain amount of time (up to two hours by default, with a ten minute inactivity timeout).

To change the defaults, create or edit a file named ~/.gnupg/gpg-agent.conf, and use the following entries:

  • default-cache-ttl specifies the amount of time a cache entry is kept after its last use, in seconds (600 by default);
  • max-cache-ttl specifies the maximum amount of time a cache entry is kept, in seconds (7200 by default).

After changing these, you’ll need to reload the configuration (try sending SIGHUP to gpg-agent, or killing it outright).


Is your private key tied to a password? This is something you set at key creation time.

If not, GPG won't ask for a password, as none is required. It will simply rely on the key you provide.

And if so, should you have entered your password during another operation right before, GPG will not ask for this password again until a few minutes have passed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.