I use ssh on my machine, and have set up a long not-human-friendly passphrase which is saved in my password manager. What makes me crazy every time is that I cannot paste into the window pictured below. I know the Remember password in my keychain option and use it. Sometimes I have to enter a new one though. Why can't I paste into a password field?

Same thing for the dialog which pops up when plugging in encrypted disks.

ssh-agent window

Some updates:

  1. I found out how i can circumvent the dialog: just use ssh-add -K ~/.ssh/id_rsa, and then I can paste the passphrase into the terminal.
  2. As mattmcmanus mentioned, my Key is encryted using pkcs8 which was broken on Yosemite's ssh-agent. This is unrelated to the above problem, but it did occur to me at the same time (read here).
  3. using ssh-add still not fixes this for encrypted disks.
  • You should accept one of the good answers below. You should also avoid asking multiple questions in a single post. Commented Jan 24, 2016 at 17:38
  • 1
    @AlainO'Dea First, yes I should, this is an old question and I forgot about it. For the second thing though: at the time of asking, it was not clear that the second issue (broken PKCS) would arise, see the edit history.
    – joni
    Commented Jan 24, 2016 at 18:00

6 Answers 6

  1. The dialog for ssh-agent can be circumvented by adding the key in the console/terminal: ssh-add ~/.ssh/id_rsa. You can then paste the password into the terminal. Also, adding the -K option to ssh-add will save it to the keychain as per Oliver Lacans comment.
  2. As mattmcmanus said, id_rsa encryption using PKCS seems to be broken on OSX Mavericks ssh-agent. The fast workaround is to decrypt the keyfile, and encrypt it again with the standard ssh procedure (Key-derivation method: MD5...):

mv id_rsa id_rsa.pkcs
openssl rsa -in id_rsa.pkcs -out id_rsa
# enter passphrase to decrypt
chmod 0600 id_rsa
ssh-keygen -f id_rsa -p
# enter passphrase to encrypt again
  • 3
    While joni's answer is excellent I would recommend ssh-add -K ~/.ssh/id_rsa which "Store passphrases in your keychain" according to ssh-add --help. It will prevent you from having to re-run ssh-add every single time you open a new shell tab or when you restart your machine. Commented Dec 2, 2015 at 8:14

Is it a PKCS#8 key and are you on mavericks? If so, that seems to be completely busted. Not sure there is a solution yet.

  • 1
    why should this be? The problem so far is just that the password field on the dialog does not accept pasting. This already existed on 10.8, but because of the update to 10.9 I have to enter the passphrase again.
    – joni
    Commented Oct 23, 2013 at 17:31
  • OK, you seem to be right... look at my own answer.
    – joni
    Commented Oct 23, 2013 at 18:19

On Mac OS X El Capitan the ssh-add command can do this with a -K option:

$ ssh-add -K ~/.ssh/id_rsa
Enter passphrase for /Users/your.username/.ssh/id_rsa:

You can paste your password into this prompt with ⌘-V.

A session for this looks like this:

$ ssh-add -K ~/.ssh/id_rsa
Enter passphrase for /Users/your.username/.ssh/id_rsa:
Passphrase stored in keychain: /Users/your.username/.ssh/id_rsa
Identity added: /Users/your.username/.ssh/id_rsa (/Users/your.username/.ssh/id_rsa)

Relevant excerpt of SSH-ADD(1) brought up with man ssh-add:

-K When adding identities, each passphrase will also be stored in your keychain. When removing identities with -d, each passphrase will be removed from your keychain.

INFOSEC NOTE: Your password won't be shown in the shell, but will be exposed to all running applications via the clipboard. An autotype solution would be more secure.


You can run a script like this in AppleScript Editor:

tell application "System Events" to tell process "SecurityAgent"
    set value of text field 2 of scroll area 1 of group 1 of window 1 to "pa55word"
    click button 2 of group 2 of window 1
end tell
  • 1
    thanks, this will help for the 'encrypted disks' dialogs. But why did apple disable this field for pasting???
    – joni
    Commented Oct 23, 2013 at 18:18
  • Handy, but yeah, don't think this solves the PKCS#8 issue, where even if you enter the correct password, it says bad passphrase.
    – Bob Aman
    Commented Jan 21, 2015 at 12:35
  • Does not make sense. Now your top-highly-secret password is open to everyone. That is why the TS uses a password manager to have her passwords centralized and highly protected.
    – wh81752
    Commented Nov 6, 2015 at 12:08
  • 1
    Doesn't work on El Capitan. First it asks for Script Editor to get Assistive Control System Events got an error: Script Editor is not allowed assistive access. Once that is allowed under System Preferences | Security & Privacy I get System Events got an error: Can’t get window 1 of process "SecurityAgent". Invalid index. Commented Jan 24, 2016 at 16:22

I had the same problem. After finding this question, I kept looking and found an answer elsewhere. This is an older question, but it has no accepted answers and is still high on search lists. (not sure of the stackexchange etiquette on that).

RE not being able to copy/paste: It's apparently by design. The intention is to prevent all access to the field from the clipboard to prevent a malicious program from scraping password boxes. I'd think pasting (and not cutting) should be allowed, but maybe there's some technical reason.

For the ssh-agent stuff, as of (at least) Yosemite, the -K option in ssh-add -K ~/.ssh/blah does what you'd like -- type the password once, it's stored in your keychain, and ssh-agent will transparently unlock for you. To try and be safer, I put my ssh passphrases in a separate keychain that locks itself periodically.


Using brew openssl and openssh fixes the issue.

brew update
brew install openssl
brew link openssl --force
brew install openssh

# confirm correct bins are being used
# both should be located in /usr/local/bin
which openssl
which openssh

# add key back to keychain
ssh-add ~/.ssh/id_rsa

I'm not sure if force linking openssl breaks anything on Mavricks. So far, I haven't noticed any issues.

  • 1
    There is no (longer a) brew formula for openssh.
    – Adam Liter
    Commented Jul 25, 2014 at 16:55
  • There is still brew tap homebrew/dupes however. That said, these steps didn't seem to resolve this issue for me.
    – Bob Aman
    Commented Jan 21, 2015 at 12:34
  • @simple10 This answer provides little to no value. You should at least provide the version of openssl / openssh that fixes the problem. Additionally please elaborate why it would do so.
    – wh81752
    Commented Nov 6, 2015 at 12:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .