Creating and managing SSH keys

ssh-keygen -t ed25519

Ed25519 is the recommended algorithm in OpenSSH 8.x and newer. It is faster and more secure than RSA-2048 or RSA-3072. The command creates two files: a private key and a public key.

2. Choose the storage location

`ssh-keygen` asks for a file path. Press Enter to accept the default location:

Enter file in which to save the key (/home/user/.ssh/id_ed25519):

The default location is `~/.ssh/id_ed25519` for the private key and `~/.ssh/id_ed25519.pub` for the public key. The SSH client automatically looks for these paths when connecting. If you want to manage multiple keys, give a custom name, for example `~/.ssh/id_ed25519_pixzo`.

3. Set a passphrase

Enter passphrase (empty for no passphrase):
Enter same passphrase again:

A passphrase encrypts the private key on disk. Without a passphrase, anyone with read access to the file can use the key directly. Always set a passphrase on keys that are on shared or production systems.

4. Check the generated files

ls -la ~/.ssh/

You will now see two files: `id_ed25519` (private) and `id_ed25519.pub` (public). The private key must only be readable by your user — check with `ls -l` that the permissions are `-rw-------`. If they are broader, correct them with:

chmod 600 ~/.ssh/id_ed25519
chmod 644 ~/.ssh/id_ed25519.pub

5. Copy the public key to the server

ssh-copy-id -i ~/.ssh/id_ed25519.pub user@server.example.com

`ssh-copy-id` places the public key in `~/.ssh/authorized_keys` on the server. This command asks once for the password of the server user. If `ssh-copy-id` does not work (for example, on a minimal Linux installation), copy the key manually:

cat ~/.ssh/id_ed25519.pub | ssh user@server.example.com "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"

6. Test key authentication

ssh user@server.example.com

If the key is correctly placed and the passphrase is correct, you will log in without a password. If you are still asked for a password, check step 5 and the permissions on the server: `~/.ssh` must be `700` and `authorized_keys` must be `600`.

7. Add the key to ssh-agent (optional)

For daily administration, you do not want to type the passphrase every time. Load the key into the SSH agent:

eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519

The agent keeps the unlocked key in memory. In a new terminal session, you must run `ssh-add` again. Use `ssh-add -l` to check which keys are loaded.

8. Secure the private key on the client

The private key never leaves the local machine. Make sure the `~/.ssh` directory itself is also well secured:

chmod 700 ~/.ssh

On a laptop that could be lost, consider an encrypted home directory or full-disk encryption. A private key with a passphrase is the last line of defense — without a passphrase, a stolen file is immediately usable.

Verification

Check whether the key works and whether the server shows the correct fingerprint:

ssh -v user@server.example.com

In the debug output, you will see `Authenticated to server.example.com ([IP]:22)` and `Server accepts key`. You can also explicitly check the public key on the server:

ssh user@server.example.com "cat ~/.ssh/authorized_keys"

The output must exactly match the contents of `~/.ssh/id_ed25519.pub` on your local machine.

Common problems

1. Permission denied (publickey) when connecting

The server does not accept the key. Check the permissions on the server: `~/.ssh` must be `700`, `authorized_keys` must be `600`. Also check that you are offering the correct key: `ssh -i ~/.ssh/id_ed25519 user@server`. On some systems, `PubkeyAuthentication no` is set in `/etc/ssh/sshd_config` — set that to `yes` and restart `sshd`.

2. `ssh-keygen` does not exist on Windows

Windows 10 (build 1809 or newer) and Windows 11 have OpenSSH built in. Open a PowerShell or Command Prompt and run `ssh-keygen.exe`. If it is not present, install the OpenSSH client via Settings → Apps → Optional features → Add a feature → OpenSSH client.

3. PuTTY keys do not work with OpenSSH

PuTTYgen stores private keys in `.ppk` format. OpenSSH uses its own format. Convert with:

puttygen id_ed25519.ppk -O private-openssh -o id_ed25519

If you do not have `puttygen` on Linux, install `putty-tools` (Debian/Ubuntu: `sudo apt install putty-tools`). You can copy the public key directly from PuTTYgen — it is compatible with `authorized_keys`.

Managing SSH keys doesn't stop at creation. Keys don't expire, so a leaked key remains valid until you manually remove it from `authorized_keys` on every server where it was ever placed — and that's exactly why you keep the number of keys small and use a separate key per environment.