How to Change the GPG Key for pass (Password Store).

How to change the GPG key used by pass. This re-encrypts your whole password store to the new GPG key.

Import your GPG secret key

1gpg --import private.key

Take the KEYID (e.g. FA0339620046E260) from the output and trust the key:

1gpg --edit-key <KEYID> trust quit

At the prompts, enter 5 (I trust ultimately), then y (really set this key to ultimate trust). Or do it non-interactively:

1expect -c 'spawn gpg --edit-key <KEYID> trust quit; send "5\ry\r"; expect eof'

Verify the key now shows [ultimate] instead of [unknown]:

1gpg --list-keys

Change the GPG key for pass

1cp -r ~/.password-store ~/.password-store.backup
2cd ~/.password-store
3pass init <new-gpg-key-hash>

You’ll see each entry re-encrypt to the new key:

1Password store initialized for <new-gpg-key-hash>
2folder1/pass1: reencrypting to <new-gpg-key-hash>
3folder2/pass1: reencrypting to <new-gpg-key-hash>
4...

Verify

Generate a new password to confirm everything still works:

1pass generate test/test

If something is wrong, restore the backup:

1mv ~/.password-store.backup ~/.password-store

Removing the old keys

Remove the old secret key:

1gpg --delete-secret-key "User Name"

Then remove the old public key:

1gpg --delete-key "User Name"