borg-key-change-passphrase(1)

✨ NAME ✨

borg-key-change-passphrase — changes the repository key file passphrase 💅

Ok bestie, this is a borg command (borg backup tool, iykyk) and it's literally just here to swap out your key file's passphrase. That's the whole gig. 🎀

---

🌸 SYNOPSIS 🌸

borg [common options] key change-passphrase [options]

---

💖 DESCRIPTION 💖

So the key files that borg uses for repository encryption can optionally be passphrase protected, and this command is the one you run when you wanna change that passphrase. Slay. 🔥

Okay but listen, this is the important part: this command only changes the passphrase. It does not change any secret that the passphrase protects (things like the encryption/MAC keys, or the chunker seed — yeah, all of that just stays the same). So if your passphrase and your borg key both got compromised, changing the passphrase afterwards does not protect your future backups (nor your past ones, bestie) to that same repository. 💀 Not the vibe you want, fr fr.

---

✨ OPTIONS ✨

• Go check borg-common(1) for the common options that all Borg commands share. That's where those live, not here. 🫶

---

🦋 EXAMPLES 🦋

Okay here's the whole glow-up in action — starting with making a key-file-protected repo:

# Create a key file protected repository
$ borg repo-create --encryption=aes256-ocb --key-location=keyfile -v
Initializing repository at "/path/to/repo"
Enter new passphrase:
Enter same passphrase again:
Do you want your passphrase to be displayed for verification? [yN]: n
Remember your passphrase. Your data will be inaccessible without it.
Key in "/root/.config/borg/keys/f23b5f0703c06dc7d9d889b5867496d8cb8ef5b42a5005221d3c7373ec6d6353" created.
Keep this key safe. Your data will be inaccessible without it.
...

# Change key file passphrase
$ borg key change-passphrase -v
Enter passphrase for key /root/.config/borg/keys/f23b5f0703c06dc7d9d889b5867496d8cb8ef5b42a5005221d3c7373ec6d6353:
Enter new passphrase:
Enter same passphrase again:
Do you want your passphrase to be displayed for verification? [yN]: n
Remember your passphrase. Your data will be inaccessible without it.
Key updated
Key location: /root/.config/borg/keys/4881c2f73d9f173bd4c4d30a9f397a596bc742bfa1f652fac3f83cee3f26cb00

🎀 Note 🎀

Not me about to explain why those two paths up there don't match 🙈 — key files that get placed automatically are named after the store hash <store_hash> of their own contents, not after the repository directory name. And because changing the passphrase re-encrypts the key, the key file gets rewritten under a brand new name and the old one gets removed. That's literally why the two paths above differ. If you wanna pick the key file name yourself, use BORG_KEY_FILE. 👑

Also, the key file paths shown above are just the Linux defaults (~/.config/borg/keys/). On macOS, key files live in ~/Library/Application Support/borg/keys/. On Windows, they're in C:\Users\<user>\AppData\Roaming\borg\keys\. Peep env_vars for the details. 💖

# Import a previously-exported key into a key file, using BORG_KEY_FILE to
# choose the output key file (creating or overwriting it).
# --key-location=keyfile is required: "borg key import" defaults to
# --key-location=repokey, which stores the key in the repository and
# ignores BORG_KEY_FILE.
$ BORG_KEY_FILE=/path/to/output-key borg key import --key-location=keyfile /path/to/exported

And if you wanna be fully automated with environment variables (main character energy tbh):

$ BORG_NEW_PASSPHRASE=old borg repo-create --encryption=aes256-ocb
# now "old" is the current passphrase.
$ BORG_PASSPHRASE=old BORG_NEW_PASSPHRASE=new borg key change-passphrase
# now "new" is the current passphrase.

---

🌈 SEE ALSO 🌈

• borg-common(1) — go read it, bestie, it's giving essential.

---

👑 AUTHOR 👑

The Borg Collective 💜

---

Ok that's the whole page, you ate it ✨ This was borg-key-change-passphrase(1) from the borg backup tool, dated 2026-10-07 — go change that passphrase, stay safe, and remember: keep this key safe, your data will be inaccessible without it 💖🦋🌸