I'm using the pass application which I find really handy. I want to change the keyphrase (mother password). I had a look at the man page there but i'm not sure what to do. Do I have to use the init command?. Is it possible to change the passphrase without reinitializing a pass store from scratch? If yes which exact command should be done?

I tried the following from the comments:

Many thank for your comment

So I did the following:

$ gpg --list-secret-keys

sec   ....
uid           [ultimate] firstnamelastname <[email protected]>
ssb   ...

sec   ....
uid           [ultimate] Firstname Lastname <[email protected]>
ssb   ...

Note the email adress is the same

There is no file ~/.gnupg/gpg.conf. I created a one and wrote default-key firstnamelastname in it and source it but got

gpg.conf:1: command not found: default-key
  • 1. there's something seriously broken with your system or your gnupg installation if using default-key in your gpg.conf causes a command not found error. This should not happen, it's like it's trying to source the gpg.conf as a script or execute it rather than parse it as a config file. 2. you should use the key fingerprint with default-key, not the name or email address. The fingerprint will be the long string of hex digits immediately after the sec line. Unlike names or email addresses, this is unique to the key-pair.
    – cas
    Oct 26, 2021 at 4:59
  • Many thanks for your comment @cas. So in my case , the key fingerprint would be firstnamelastname correct? Do you think that it can have to do with the fact that I am on MacOS?
    – ecjb
    Oct 27, 2021 at 8:16
  • No, it would be the long string of hex digits (e.g. "3F93BFC18E47EC42E3A2C20218D52ABC8E47EC42" as a made up example). This will be on the line immediately after the sec line when you run gpg --list-secret-keys
    – cas
    Oct 27, 2021 at 8:53

1 Answer 1


pass uses gpg to encrypt your password store. To change the passphrase for pass, you need to change the passphrase for your gpg key.


gpg --change-passphrase user-id
  • Many thanks @cas! May I ask you how and where this information can be found?
    – ecjb
    Oct 24, 2021 at 9:13
  • Well actually @cas I did the command and could a keyphrase and I thought it worked, but now I still have to give the old keyphrase to have access to the passwords as if nothing had changed. What am I doing wrong?
    – ecjb
    Oct 24, 2021 at 10:08
  • did you use a different gpg key for pass? If so, you have to change the passphrase for the key used by pass (i ran into this issue myself several years ago when I generated a new key). As for where the info can be found, in the pass docs - it clearly states that it uses gpg to handle encryption (and git for revision history).
    – cas
    Oct 24, 2021 at 10:21
  • Many thanks for your answer @cas. what do you mean by key? is it the same as the user-id? If the key is neither the user-id nore the keyphrase, what is it and do you have an Idea about how I could troubleshoot the next step?
    – ecjb
    Oct 24, 2021 at 17:53
  • by "key", I actually meant "key pair" - a public and a private key. A key pair is associated with a user-id (typically a name, or an email address, etc. it's an identifier that doesn't have to be unique). gpg can manage the crypto key pairs for multiple user ids at the same time (e.g. if you have multiple separate and unrelated email addresses, they can each have their own key)....and it can manage multiple key pairs for the same id (e.g. an old and a new key for the same address. or a key you use for work, one you use for a particular project, and one you use for personal stuff)
    – cas
    Oct 25, 2021 at 0:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .