{"record":{"id":"26cc33a287d05bbd","repo":"phacility/phabricator","slug":"a-passphrase-was-provided-for-this-private-key-bu","errorCode":null,"errorMessage":"A passphrase was provided for this private key, but it does not require a passphrase. Check that you supplied the correct key, or omit the passphrase.","messagePattern":"A passphrase was provided for this private key, but it does not require a passphrase\\. Check that you supplied the correct key, or omit the passphrase\\.","errorType":"exception","errorClass":"PhabricatorAuthSSHPrivateKeySurplusPassphraseException","httpStatus":null,"severity":"error","filePath":"src/applications/auth/sshkey/PhabricatorAuthSSHPrivateKey.php","lineNumber":117,"sourceCode":"    //\n    //   - We were given a passphrase, but the key has no passphrase.\n    //   - We were given a passphrase, but the passphrase is wrong.\n    //   - We were not given a passphrase, but the key has a passphrase.\n    //   - The key format is invalid.\n    //\n    // Our ability to separate these cases varies a lot, particularly because\n    // some versions of \"ssh-keygen\" return very similar diagnostic messages\n    // for any error condition. Try our best.\n\n    if ($passphrase) {\n      // First, test for \"we were given a passphrase, but the key has no\n      // passphrase\", since this is a conclusive test.\n      list($err) = exec_manual(\n        'ssh-keygen -y -P %s -f %R',\n        '',\n        $tmp);\n      if (!$err) {\n        throw new PhabricatorAuthSSHPrivateKeySurplusPassphraseException(\n          pht(\n            'A passphrase was provided for this private key, but it does '.\n            'not require a passphrase. Check that you supplied the correct '.\n            'key, or omit the passphrase.'));\n      }\n    }\n\n    // We're out of conclusive tests, so try to guess why the error occurred.\n    // In some versions of \"ssh-keygen\", we get a usable diagnostic message. In\n    // other versions, not so much.\n\n    $reason_format = 'format';\n    $reason_passphrase = 'passphrase';\n    $reason_unknown = 'unknown';\n\n    $patterns = array(\n      // macOS 10.14.6\n      '/incorrect passphrase supplied to decrypt private key/'","sourceCodeStart":99,"sourceCodeEnd":135,"githubUrl":"https://github.com/phacility/phabricator/blob/5720a38cfe95b00ca4be5016dd0d2f3195f4fa04/src/applications/auth/sshkey/PhabricatorAuthSSHPrivateKey.php#L99-L135","documentation":"When decrypting a private key fails and a passphrase was supplied, PhabricatorAuthSSHPrivateKey first runs the conclusive test 'ssh-keygen -y -P \"\" -f <key>' (empty passphrase). If that succeeds, the key has no passphrase at all, so the supplied passphrase is provably surplus and the dedicated PhabricatorAuthSSHPrivateKeySurplusPassphraseException is thrown.","triggerScenarios":"Calling newBarePrivateKey($passphrase) with a non-empty passphrase for a key that is not passphrase-protected, e.g. a credential form where the user typed a passphrase while pasting an unencrypted key.","commonSituations":"Users habitually filling in the passphrase field on every key form; pasting a different (unencrypted) key than the one the passphrase belongs to; automation that always passes a passphrase regardless of key type.","solutions":["Leave the passphrase field empty and retry","Confirm you pasted the intended key - the passphrase probably belongs to a different key file","If you meant to use an encrypted key, paste that key's full text instead"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  $bare = $private_key->newBarePrivateKey($passphrase);\n} catch (PhabricatorAuthSSHPrivateKeySurplusPassphraseException $ex) {\n  // Key is unencrypted: retry with no passphrase.\n  $bare = $private_key->newBarePrivateKey(new PhutilOpaqueEnvelope(''));\n} catch (PhabricatorAuthSSHPrivateKeyException $ex) {\n  // All other key/passphrase failures share this abstract base.\n  throw $ex;\n}","preventionTips":["Leave the passphrase field empty for unencrypted keys - only fill it when the key asks for one","Confirm the pasted key file is the one the passphrase belongs to","Test locally first: ssh-keygen -y -f keyfile (no -P) succeeding means no passphrase is needed"],"tags":["ssh","private-key","passphrase","phabricator"],"backgroundTag":"ssh-key-passphrase-mismatch","analyzedSha":"5720a38cfe95b00ca4be5016dd0d2f3195f4fa04","analyzedAt":"2026-08-21T05:07:25.672Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}