Manage GPG keys

14 Sep 2026

Here’s how to manage GPG keys meant for pass.

Howto change master password (GPG passphrase)

Open your terminal and list your keys to find your Key ID or email:
```
 gpg --list-secret-keys --keyid-format LONG
```
Run the edit command (replace user@example.com with your email or Key ID):
```
 gpg --edit-key user@example.com
```
At the gpg> prompt, type:
```
 passwd
```
GPG will prompt you to enter your current passphrase, followed by your new passphrase.
Save and exit by typing:
```
 save
```

Howto change to a completely new GPG key

If your old key is compromised, or you want to upgrade to a stronger encryption algorithm (like Ed25519/X25519), you can generate a new key and tell pass to re-encrypt everything.

Generate a new GPG key
```
 gpg --full-generate-key
```
Follow the prompts to choose your encryption type, key size, expiration, and your new master passphrase.
Get your new Key ID

List your keys to find the 8, 16, or 40-character hex ID of your newly created key:
```
 gpg --list-secret-keys --keyid-format LONG
```
Re-initialize pass with the new key

Run the pass init command using your new Key ID. pass will automatically detect your existing password store, decrypt all your current passwords using your old key, and re-encrypt them using your new key:
```
 pass init <YOUR_NEW_GPG_KEY_ID>
```

Howto delete an old GPG key

To delete an old GPG key from your system, you must delete both the private (secret) key and the public key. GPG will not allow you to delete a public key if the private key still exists.

Before proceeding, ensure you have already re-encrypted your password store with your new key using pass init <NEW_KEY_ID>.

Find your old Key ID or Email

List your keys to locate the unique identifier (the long hexadecimal string or email address) of the old key:
```
 gpg --list-secret-keys --keyid-format LONG
```
Delete the private key first

You must delete the secret part of the key first. Replace old_key_id with your actual Key ID or email:
```
 gpg --delete-secret-keys old_key_id
```
Delete the public key

Once the private key is gone, you can delete the remaining public key:
```
 gpg --delete-keys old_key_id
```
Verify the key is gone

Run the following list commands to make sure the old key no longer appears in your keyring:
```
 gpg --list-keys
 gpg --list-secret-keys
```