How and where can I check what keys have been added with ssh-add to my ssh-agent?

2 Answers 2


Use ssh-add -l to list them by fingerprint.

$ ssh-add -l
2048 72:...:eb /home/gert/.ssh/mykey (RSA)

Or ssh-add -L to get the full key in OpenSSH format.

$ ssh-add -L
ssh-rsa AAAAB3NzaC1yc[...]B63SQ== /home/gert/.ssh/id_rsa

The latter format is the same as you would put them in a ~/.ssh/authorized_keys file.

  • 5
    [rahul@srv1~]$ ssh-add -l Could not open a connection to your authentication agent. Commented Dec 20, 2012 at 11:11
  • 4
    You could run this command on the remote host if key agent forwarding is enabled.
    – phemmer
    Commented Mar 30, 2013 at 19:58
  • 4
    Example: ssh-agent sh -c 'ssh-add; ssh-add -l'
    – kenorb
    Commented Mar 26, 2015 at 21:15
  • 5
    I thought ssh-agent would have an option to perform this. Commented May 6, 2016 at 13:25
  • 8
    @gertvdijk I was in fact talking about naming. From the name ssh-add it sounds like this command should only add keys to agent. And then ssh-agent should know what keys its holding. My perspective was different. Commented May 6, 2016 at 13:43

Surprisingly the MacOS version of ssh-add at some point stopped showing the filename's as with the Linux variant. I wrote this script which does the same for fingerprints that have a corresponding file in ~/.ssh/.

I call the function ssh-add_wf, wf = with file. The details on the function are below:

$ type ssh-add_wf
ssh-add_wf is a function
ssh-add_wf ()
    while read -r line; do
        for file in ~/.ssh/*.pub;
            printf "%s %s\n" "$(ssh-keygen -lf "$file" | awk '{$1=""}1')" "$file";
        done | column -t | grep --color=auto "$line" || echo "$line";
    done < <(ssh-add -l | awk '{print $2}')


$  ssh-add_wf
 SHA256:mwvSCr2CXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX  [email protected]  (RSA)  /Users/myuser/.ssh/[email protected]_id_rsa.pub
 SHA256:qInIrnKcXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX  [email protected]  (RSA)  /Users/myuser/.ssh/[email protected]_id_rsa.pub
 SHA256:EyNkhTLQXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX  [email protected]  (RSA)  /Users/myuser/.ssh/[email protected]_id_rsa.pub

Above, any keys within ssh-add's output that match to a file in ~/.ssh/ directory will include the file's name in the output in the 4th column. Any keys that do not will have that column empty. In this output we have 3 keys which have files that match.

Mechanics of function

The script uses 2 loops. The outside loop is a while which takes the output of ssh-add. This output is all the fingerprints of SSH keys loaded into ssh-agent.

The interior loop is a for loop which goes thru the contents of all the files matching this pattern, ~/.ssh/*.pub. For each file we interrogate it with ssh-keygen -lf <file> and then drop the first column of this output:





This string is then printed along with the name of the file:

printf "%s %s\n" "$(ssh-keygen -lf "$file" | awk '{$1=""}1')" "$file"

At the end of the execution of this loop is the following:

| column -t | grep "$line" || echo "$line"

This formats the output so that it's column formatted (column -t).

At this point we look at this output for the fingerprint from ssh-add via the grep "$line". If a match is found we print our printf output, otherwise we fall back to just printing the original fingerprint from ssh-add, $line.


  • 4
    What happened is that OpenSSH adopted a new private key storage format that has support for comments inside the private key, which of course can't be changed if you don't have the passphrase. If the private key is stored in this new file format (which you can recognize by the BEGIN OPENSSH PRIVATE KEY at the top of the file) , then ssh-add -l displays it; if not, it instead displays the name of the file from which the key was loaded.
    – Mark Reed
    Commented Dec 9, 2020 at 20:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .