With public-key encryption, one can encrypt and decrypt a file repeatedly if gpg-agent caches the passphrase for the key. However, with symmetric encryption I'm always prompted for the passphrase when encrypting even if gpg-agent obviously has the passphrase cached because I'm not prompted when decrypting.

This is related to gpg2 --symmetric and passphrase, but there the OP wants to be prompted always, here I want to be never prompted. Can gpg/gpg-agent be configured to do that?

  • What is your question?
    – Tom K.
    Jan 23, 2018 at 12:43
  • So you want gpg-agent to cache the same passphrase to be used every time you're encrypting any file symmetrically? Jan 24, 2018 at 22:34
  • Yes. For convenience, but also because I don't want to accidentally change the password and lose information.
    – melisgl
    Jan 26, 2018 at 13:50

2 Answers 2


I also wanted to do this (with symmetric encryption, no keys) and Xen2050's mention of gpg-preset-passphrase was helpful, but I still was stuck on how to derive the correct cacheid to use with gpg-preset-passphrase to associate the passphrase with the encrypted file.

tl;dr the cacheid is the 8-octet hex-encoded s2k salt randomly chosen on encryption, prefixed with the letter "S", e.g. S0123456789ABCDEF:

/path/to/gpg-preset-passphrase --preset S0123456789ABCDEF <<EOF

See this detailed answer for instructions on encrypting, getting the cacheid, presetting, and decrypting with passphrase from variable (no prompts at all): https://superuser.com/a/1485486/1093343


Since your commenting "For convenience, but also because I don't want to accidentally change the password and lose information" I'd suggest using a keyfile instead, it won't change. And gpg wouldn't know what cached passphrase you wanted to use when symmetrically encrypting a new file anyway.

But storing and using a keyfile safely becomes an issue. Storing it encrypted should be safe.

  • Using a very small LUKS container should store and decrypt it safely
  • Or store it encrypted in a gpg file, and extracted to ramfs (note tmpfs could be written to cache).

Then you can close the LUKS container or delete the file whenever you want to, and not worry about entering the passphrase correctly the first time if you only relied on gpg-agent's own caching.

Or, just use a gpg public key.

There's also gpg-preset-passphrase to "Put a passphrase into gpg-agent's cache":

The gpg-preset-passphrase is a utility to seed the internal cache of a running gpg-agent with passphrases. It is mainly useful for unattended machines, where the usual pinentry tool may not be used and the passphrases for the to be used keys are given at machine startup.

Passphrases set with this utility don't expire unless the --forget option is used to explicitly clear them from the cache --- or gpg-agent is either restarted or reloaded (by sending a SIGHUP to it). Note that the maximum cache time as set with --max-cache-ttl is still honored. It is necessary to allow this passphrase presetting by starting gpg-agent with the --allow-preset-passphrase.

  • Could you point to some resources for creating a symmetric keyfile with gpg?
    – 371273
    Dec 26, 2018 at 14:52
  • @MattReyer I've read general good advice for linux is to read a few random bytes (32, 64, 128, 256, depends on the cipher & perhaps key processing) from /dev/random on a running well-used system (an embedded system with virtually no input may have poor "randomness"). Cryptsetup's FAQ 2.12 What are the security requirements for a key read from file? has head -c 256 /dev/random > keyfile
    – Xen2050
    Dec 26, 2018 at 15:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .