phacility/phabricator · error · PhabricatorAuthSSHPrivateKeyIncorrectPassphraseException

This private key requires a passphrase, but no passphrase wa

Error message

This private key requires a passphrase, but no passphrase was provided. Check that you supplied the correct key, or provide the passphrase.

What it means

The mirror case of the wrong-passphrase branch: ssh-keygen's diagnostics indicate the key requires a passphrase, but no passphrase was passed to newBarePrivateKey(), so PhabricatorAuthSSHPrivateKeyIncorrectPassphraseException is thrown with the 'no passphrase was provided' wording.

Source

Thrown at src/applications/auth/sshkey/PhabricatorAuthSSHPrivateKey.php:177

      }
    }

    if ($reason === $reason_format) {
      throw new PhabricatorAuthSSHPrivateKeyFormatException(
        pht(
          'This private key is not formatted correctly. Check that you '.
          'have provided the complete text of a valid private key.'));
    }

    if ($reason === $reason_passphrase) {
      if ($passphrase) {
        throw new PhabricatorAuthSSHPrivateKeyIncorrectPassphraseException(
          pht(
            'This private key requires a passphrase, but the wrong '.
            'passphrase was provided. Check that you supplied the correct '.
            'key and passphrase.'));
      } else {
        throw new PhabricatorAuthSSHPrivateKeyIncorrectPassphraseException(
          pht(
            'This private key requires a passphrase, but no passphrase was '.
            'provided. Check that you supplied the correct key, or provide '.
            'the passphrase.'));
      }
    }

    if ($passphrase) {
      throw new PhabricatorAuthSSHPrivateKeyUnknownException(
        pht(
          'This private key could not be opened with the provided passphrase. '.
          'This might mean that the passphrase is wrong or that the key is '.
          'not formatted correctly. Check that you have supplied the '.
          'complete text of a valid private key and the correct passphrase.'));
    } else {
      throw new PhabricatorAuthSSHPrivateKeyUnknownException(
        pht(
          'This private key could not be opened. This might mean that the '.

View on GitHub (pinned to 5720a38cfe)

Solutions

Supply the key's passphrase and retry
If you believe the key is unencrypted, re-check the key text - diagnostics say it is protected
If the passphrase is unknown, generate a new key pair and replace the credential

Defensive patterns

Strategy: try-catch

Try / catch

try {
  $bare = $private_key->newBarePrivateKey($passphrase);
} catch (PhabricatorAuthSSHPrivateKeyIncorrectPassphraseException $ex) {
  // Covers both wrong- and missing-passphrase messages:
  // prompt the user for the passphrase and resubmit once.
  $prompt_for_passphrase = true;
} catch (PhabricatorAuthSSHPrivateKeyException $ex) {
  throw $ex;
}

Prevention

Check whether a key is encrypted before importing: 'ssh-keygen -y -f keyfile' prompting for a passphrase means one is required
Always capture the passphrase when generating keys that will be imported into credential storage

When it happens

Trigger: Calling newBarePrivateKey() with an empty/null passphrase on a passphrase-protected key - e.g. a credential form submitted with the passphrase field left blank for an encrypted key.

Common situations: Users skipping the passphrase field assuming the key is unencrypted; automation importing keys without a passphrase parameter; passphrases lost in transcription between systems.

Related errors

AI-assisted analysis of phacility/phabricator@5720a38cfe (2026-08-21). Data as JSON: /api/errors/0f3ef333036f80fe. Report an issue: GitHub.