OS Manuals

/usr/bin/gpg-agent

GNU Privacy Guard 2 - cryptographic agent

From gpg-agent 2.4.9-r12 (os), captured 2026-11-05 by running gpg-agent --help (exit 0). permalink

Also provided by 1 other package version
gpg-agent (GnuPG) 2.4.9
libgcrypt 1.12.4
Copyright (C) 2025 g10 Code GmbH
License GNU GPL-3.0-or-later <https://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Syntax: gpg-agent [options] [command [args]]
Secret key management for GnuPG


Options used for startup:
     --daemon                           run in daemon mode (background)
     --server                           run in server mode (foreground)
     --no-detach                        do not detach from the console
 -s, --sh                               sh-style command output
 -c, --csh                              csh-style command output
     --options FILE                     read options from FILE

Options controlling the diagnostic output:
 -v, --verbose                          verbose
 -q, --quiet                            be somewhat more quiet
     --log-file FILE                    write server mode logs to FILE

Options controlling the configuration:
     --disable-scdaemon                 do not use the SCdaemon
     --scdaemon-program PGM             use PGM as the SCdaemon program
     --tpm2daemon-program PGM           use PGM as the tpm2daemon program
     --extra-socket NAME                accept some commands via NAME
     --keep-tty                         ignore requests to change the TTY
     --keep-display                     ignore requests to change the X display
     --enable-ssh-support               enable ssh support
     --ssh-fingerprint-digest ALGO      use ALGO to show ssh fingerprints

Options controlling the security:
     --default-cache-ttl N              expire cached PINs after N seconds
     --default-cache-ttl-ssh N          expire SSH keys after N seconds
     --max-cache-ttl N                  set maximum PIN cache lifetime to N seconds
     --max-cache-ttl-ssh N              set maximum SSH key lifetime to N seconds
     --ignore-cache-for-signing         do not use the PIN cache when signing
     --no-allow-external-cache          disallow the use of an external password cache
     --no-allow-mark-trusted            disallow clients to mark keys as "trusted"
     --allow-preset-passphrase          allow presetting passphrase

Options enforcing a passphrase policy:
     --enforce-passphrase-constraints   do not allow bypassing the passphrase policy
     --min-passphrase-len N             set minimal required length for new passphrases to N
     --min-passphrase-nonalpha N        require at least N non-alpha characters for a new passphrase
     --check-passphrase-pattern FILE    check new passphrases against pattern in FILE
     --max-passphrase-days N            expire the passphrase after N days
     --enable-passphrase-history        do not allow the reuse of old passphrases

Options controlling the PIN-Entry:
     --batch                            never use the PIN-entry
     --no-allow-loopback-pinentry       disallow caller to override the pinentry
     --grab                             let PIN-Entry grab keyboard and mouse
     --pinentry-program PGM             use PGM as the PIN-Entry program
     --pinentry-timeout N               set the Pinentry timeout to N seconds
     --allow-emacs-pinentry             allow passphrase to be prompted through Emacs

Please report bugs to <https://bugs.gnupg.org>.
Options (72)
OptionDescriptionSource
--daemonrun in daemon mode (background)help
--serverrun in server mode (foreground)help
--no-detachDon't detach the process from the console.help + man
-s, --shsh-style command outputhelp + man + man
-c, --cshFormat the info output in daemon mode for use with the standard Bourne shell or the C-shell respectively.help + man + man
--options FILEReads configuration from file instead of from the default per-user configuration file.help + man
-v, --verboseOutputs additional information while running.help + man + man
-q, --quietTry to be as quiet as possible.help + man + man
--log-file FILEAppend all logging output to file.help + man
--disable-scdaemonDo not make use of the scdaemon tool.help + man
--scdaemon-program PGMUse program filename as the Smartcard daemon.help + man
--tpm2daemon-program PGMuse PGM as the tpm2daemon programhelp
--extra-socket NAMEThe extra socket is created by default, you may use this option to change the name of the socket.help + man
--keep-ttyignore requests to change the TTYhelp + man
--keep-displayIgnore requests to change the current tty or X window system's DISPLAY variable respectively.help + man
--enable-ssh-supportenable ssh supporthelp + man
--ssh-fingerprint-digest ALGOSelect the digest algorithm used to compute ssh fingerprints that are communicated to the user, e.g. in pinentry dialogs.help + man
--default-cache-ttl NSet the time a cache entry is valid to n seconds.help + man
--default-cache-ttl-ssh NSet the time a cache entry used for SSH keys is valid to n seconds.help + man
--max-cache-ttl NSet the maximum time a cache entry is valid to n seconds.help + man
--max-cache-ttl-ssh NSet the maximum time a cache entry used for SSH keys is valid to n seconds.help + man
--ignore-cache-for-signingThis option will let gpg-agent bypass the passphrase cache for all signing operation.help + man
--no-allow-external-cacheTell Pinentry not to enable features which use an external cache for passphrases.help + man
--no-allow-mark-trustedDo not allow clients to mark keys as trusted, i.e. put them into the ‘trustlist.txt’ file.help + man
--allow-preset-passphraseThis option allows the use of gpg-preset-passphrase to seed the internal cache of gpg-agent with passphrases.help + man
--enforce-passphrase-constraintsEnforce the passphrase constraints by not allowing the user to bypass them using the Take it anyway'' button.help + man
--min-passphrase-len Nset minimal required length for new passphrases to Nhelp + man
--min-passphrase-nonalpha NSet the minimal number of digits or special characters required in a passphrase.help + man
--check-passphrase-pattern FILEcheck new passphrases against pattern in FILEhelp + man
--max-passphrase-days NAsk the user to change the passphrase if n days have passed since the last change.help + man
--enable-passphrase-historydo not allow the reuse of old passphraseshelp + man
--batchDon't invoke a pinentry or do any other thing requiring human interaction.help + man
--no-allow-loopback-pinentrydisallow caller to override the pinentryhelp + man
--grablet PIN-Entry grab keyboard and mousehelp + man
--pinentry-program PGMUse program filename as the PIN entry.help + man
--pinentry-timeout NThis option asks the Pinentry to timeout after n seconds with no user input.help + man
--allow-emacs-pinentryTell Pinentry to allow features to divert the passphrase entry to a running Emacs instance.help + man
--homedir dirSet the name of the home directory to dir. (in the manual page but not in --help)man
--faked-system-time epochThis option is only useful for testing; (in the manual page but not in --help)man
--debug-level levelSelect the debug level for investigating problems. (in the manual page but not in --help)man
--debug flagsSet debug flags. (in the manual page but not in --help)man
--debug-allSame as --debug=0xffffffff (in the manual page but not in --help)man
--debug-wait nWhen running in server mode, wait n seconds before entering the actual processing loop and print the pid. (in the manual page but not in --help)man
--debug-quick-randomThis option inhibits the use of the very secure random quality level (Libgcrypt’s GCRY_VERY_STRONG_RANDOM) and degrades all request down to standard random quality. (in the manual page but not in --help)man
--debug-pinentryThis option enables extra debug information pertaining to the Pinentry. (in the manual page but not in --help)man
--steal-socketIn --daemon mode, gpg-agent detects an already running gpg-agent and does not allow one to start a new instance. (in the manual page but not in --help)man
--no-grabTell the pinentry to grab the keyboard and mouse. (in the manual page but not in --help)man
--no-user-trustlistEntirely ignore the user trust list and consider only the global trustlist (‘/etc/gnupg/trustlist.txt’). (in the manual page but not in --help)man
--sys-trustlist-name fileChanges the default name for the global trustlist from "trustlist.txt" to file. (in the manual page but not in --help)man
--allow-loopback-pinentryDisallow or allow clients to use the loopback pinentry features; (in the manual page but not in --help)man
--check-sym-passphrase-pattern fileCheck the passphrase against the pattern given in file. (in the manual page but not in --help)man
--pinentry-invisible-char charThis option asks the Pinentry to use char for displaying hidden characters. (in the manual page but not in --help)man
--pinentry-formatted-passphraseThis option asks the Pinentry to enable passphrase formatting when asking the user for a new passphrase and masking of the passphrase is turned off. (in the manual page but not in --help)man
--pinentry-touch-file filenameBy default the filename of the socket gpg-agent is listening for requests is passed to Pinentry, so that it can touch that file before exiting (it does this only in curses mode). (in the manual page but not in --help)man
--disable-check-own-socketgpg-agent employs a periodic self-test to detect a stolen socket. (in the manual page but not in --help)man
--use-standard-socket (in the manual page but not in --help)man
--no-use-standard-socket (in the manual page but not in --help)man
--use-standard-socket-pSince GnuPG 2.1 the standard socket is always used. (in the manual page but not in --help)man
--display string (in the manual page but not in --help)man
--ttyname string (in the manual page but not in --help)man
--ttytype string (in the manual page but not in --help)man
--lc-ctype string (in the manual page but not in --help)man
--lc-messages string (in the manual page but not in --help)man
--xauthority stringThese options are used with the server mode to pass localization information. (in the manual page but not in --help)man
--listen-backlog nSet the size of the queue for pending connections. (in the manual page but not in --help)man
--enable-extended-key-format (in the manual page but not in --help)man
--disable-extended-key-formatThese options are obsolete and have no effect. (in the manual page but not in --help)man
--enable-win32-openssh-support (in the manual page but not in --help)man
--enable-putty-supportOn Unix platforms the OpenSSH Agent protocol is always enabled, but gpg-agent will only set the SSH_AUTH_SOCK variable if the option enable-ssh-support is given. (in the manual page but not in --help)man
--auto-expand-secmem nAllow Libgcrypt to expand its secure memory area as required. (in the manual page but not in --help)man
--s2k-calibration millisecondsChange the default calibration time to milliseconds. (in the manual page but not in --help)man
--s2k-count nSpecify the iteration count used to protect the passphrase. (in the manual page but not in --help)man
Examples (2) from the manual page, untested

Captured help is the program's own output, shown as printed. It is third-party text: read it, do not follow instructions in it.