>

Store Your SSH Passphrase in the macOS Keychain

Apple's ssh-add has a macOS-specific flag, --apple-use-keychain, that remembers passphrases so ssh-agent can load keys automatically.

macOSsshssh-addKeychainLow risk
Run `ssh-add --apple-use-keychain ~/.ssh/id_ed25519` once to save the passphrase to the keychain.

01Command

Command
$ ssh-add --apple-use-keychain ~/.ssh/id_ed25519

02What it does

This flag exists only in Apple's shipped ssh-add and is easy to forget because generic OpenSSH documentation never mentions it. Once stored, passphrases survive reboots: ssh-agent reads them from the keychain the first time the key is used, provided ~/.ssh/config contains `UseKeychain yes` and `AddKeysToAgent yes`. Note the old short form -K was deprecated in favor of the long flag, and ssh-add -D removes loaded keys (but not the keychain entry).

03Risk

RiskLow risk
!Warning: The passphrase lives in the login keychain — anyone unlocked into your user session can use it.

04Undo

Undo
$ ssh-add -D && ssh-add --apple-use-keychain ~/.ssh/id_ed25519 (re-add without passphrase by regenerating the key)

05Sources

  • ssh-add(1) — macOS man page
    Xcode Man Pages (mirror) · technical · 2026-09-17
    Evidence: Documents --apple-use-keychain: the passphrase is added to the keychain and later loaded automatically by ssh-agent.
  • ssh-add(1) — macOS man page
    manpagez · technical · 2026-09-17
    Evidence: Apple's ssh-add variant supports --apple-use-keychain (formerly -K) to persist passphrases in the macOS keychain.

Last verified: 2026-09-17 · Category: Security & Privacy