How to Create an SSH Key

An SSH key is two files: a private half that never leaves your computer, and a public half you hand out freely. Anyone who has the public half can let you in, and can’t do anything else with it.

These commands run on your own computer, not on the server you’re trying to reach. That distinction is the one people get wrong, and it’s why keys sometimes end up generated on the wrong machine entirely.

Before You Start

• A terminal on the computer you’ll be connecting from
• Nothing else. ssh-keygen ships with Ubuntu, with macOS, and with Windows 10 and later

Step 1: Generate the Key

ssh-keygen -t ed25519 -C "[email protected]"

It asks where to save it, which you can answer by pressing enter for the default, then for a passphrase, twice. -C sets a comment that rides along on the public half, and an email or a machine name there saves you guessing which key is which in two years.

Use ed25519 unless something at the other end refuses it. It’s shorter and faster than RSA, and it’s been the sensible default for years.

A passphrase means a stolen laptop isn’t a stolen server. Leaving it blank is defensible for a key that only ever automates a deployment, and a bad idea for the key you log in with.

Step 2: Read the Public Half

cat ~/.ssh/id_ed25519.pub

ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHqZ8kL2mR4pQxVwT7nBcF3sD9yJ1aE6uG0hK5vXwPzR [email protected]

That’s the one to send to whoever administers the server, and it’s safe to paste anywhere. The file next to it with no .pub on the end is the private half, and that one never gets copied, emailed or committed.

Verify It Worked

ssh-keygen -l -f ~/.ssh/id_ed25519.pub

256 SHA256:6dPmT1kQ9xW3nRvZ8cYhB2sL5jA7eF0gU4iO1pXtM3k [email protected] (ED25519)

A fingerprint, the comment, and the key type in brackets. If that command errors instead, the file didn’t get written where you expected and step 1 is worth repeating.

On macOS and Windows

ssh-keygen -t ed25519 -C "[email protected]" is the same command everywhere. What changes is where the files land and what runs the agent.

On macOS the paths are identical to Linux, and you can hand the passphrase to the keychain so you’re not typing it all day:

ssh-add --apple-use-keychain ~/.ssh/id_ed25519

On Windows, run it in PowerShell. The keys go to C:\Users\you\.ssh\, and the agent is a service that isn’t started by default:

Get-Service ssh-agent | Set-Service -StartupType Automatic
Start-Service ssh-agent
ssh-add $env:USERPROFILE\.ssh\id_ed25519

The badge on this page covers the Linux commands only. The runner tests on Ubuntu, so the macOS and Windows lines above are the two I can’t put a server behind, and they’re marked as not executed for that reason.

Conclusion

You’ve got a key pair, and a public half you can hand out without a second thought. The usual next step is somebody putting it on a server for you, which is what adding a user and giving them sudo covers from the other side.

If the commands behave differently on your machine, do drop me a line at [email protected] with what you’re running and I’ll get it retested.