How to create and use SSH keys

Updated 2026-10-30

An SSH key is a pair of files: a private key that stays on your computer and a public key you put on the server. Create one with ssh-keygen -t ed25519, add the public key to the server, and you log in without a password and with far better security.

This guide covers Linux, macOS and Windows, then the details that make keys pleasant to use.

Why keys beat passwords

Every server on the internet sees constant password-guessing attempts on port 22. A strong password slows them down; a key stops them, because there is nothing to guess. Keys also make automation possible: scripts, deploy tools and CI can log in without storing a password.

1. Create a key

Linux and macOS

Open a terminal and run:

ssh-keygen -t ed25519 -C "laptop-2026"

• -t ed25519 picks the modern key type.
• -C adds a comment so you can recognise the key later. Use the device name, not an email address if you prefer privacy.

Accept the default path (~/.ssh/id_ed25519) and set a passphrase. You now have:

~/.ssh/id_ed25519       # private key, never share
~/.ssh/id_ed25519.pub   # public key, safe to share

Windows 10 and 11

Windows ships OpenSSH. Open PowerShell and run the same command:

ssh-keygen -t ed25519 -C "desktop-2026"

The files land in C:\Users\<you>\.ssh\. If you use PuTTY, you can import the private key into PuTTYgen and save it as a .ppk file.

2. Look at your public key

cat ~/.ssh/id_ed25519.pub

It is a single line starting with ssh-ed25519. This is the part you copy to servers and to the console.

3. Put the key on a server

Option A: when you create the server

The easiest way. In the Wolkra console, add the public key under SSH keys, then select it when you create a server. The key is written to the root account on first boot and no password is sent. See connect with SSH.

Option B: with ssh-copy-id

If the server already exists and you can log in with a password:

ssh-copy-id -i ~/.ssh/id_ed25519.pub [email protected]   # example address

Option C: by hand

On Windows, or when ssh-copy-id is not available, paste the key into the server's authorized_keys:

mkdir -p ~/.ssh && chmod 700 ~/.ssh
echo 'ssh-ed25519 AAAA... laptop-2026' >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys

The permissions matter. If ~/.ssh or authorized_keys is writable by others, OpenSSH ignores the file.

4. Log in

ssh [email protected]

If you have several keys, name the one to use:

ssh -i ~/.ssh/id_ed25519 [email protected]

5. Use ssh-agent so you type the passphrase once

macOS

ssh-add --apple-use-keychain ~/.ssh/id_ed25519

Then add to ~/.ssh/config:

Host *
  AddKeysToAgent yes
  UseKeychain yes

Linux

Most desktops start an agent automatically. Otherwise:

eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519

Windows

Get-Service ssh-agent | Set-Service -StartupType Automatic
Start-Service ssh-agent
ssh-add $env:USERPROFILE\.ssh\id_ed25519

6. Write an SSH config file

A config file turns long commands into short names. Create ~/.ssh/config:

Host web
  HostName 203.0.113.10
  User deploy
  IdentityFile ~/.ssh/id_ed25519

Host db
  HostName 10.0.0.5
  User deploy
  ProxyJump web

Now ssh web connects to the first server, and ssh db reaches a server on a private network by jumping through web. That is how you manage servers that have no public IP, for example on a private network. (Addresses are examples.)

7. Copy files with the same key

scp and rsync use the same keys and config:

scp backup.tar.gz web:/home/deploy/
rsync -avz ./site/ web:/var/www/site/

8. Disable password login on the server

When key login works, turn passwords off so the server only accepts keys:

sudo tee /etc/ssh/sshd_config.d/10-keys-only.conf >/dev/null <<'EOF'
PasswordAuthentication no
KbdInteractiveAuthentication no
PermitRootLogin prohibit-password
EOF
sudo sshd -t && sudo systemctl reload ssh

Keep an existing session open while you test a new one. prohibit-password lets root log in with a key only; set it to no once you work from a sudo user. More in securing an Ubuntu server.

9. Rotate and revoke keys

Good habits:

• One key per device. If a laptop is lost, remove just that key.
• Comments that mean something. laptop-2026 is easier to find than user@host.
• Review authorized_keys now and then and remove keys nobody uses.

To revoke a key, delete its line from ~/.ssh/authorized_keys on every server. To replace it, add the new key first, test, then remove the old one.

10. Optional: hardware keys

OpenSSH supports FIDO2 security keys. With a compatible key plugged in:

ssh-keygen -t ed25519-sk -C "yubikey"

The private key cannot be copied off the device, and each login needs a touch. It is the strongest option for admin accounts.

11. Use SSH keys for deploys and CI

Automated systems should not use your personal key. Create a separate key without a passphrase for each system, and restrict what it can do on the server:

ssh-keygen -t ed25519 -f ~/.ssh/deploy_ci -N "" -C "ci-deploy"

On the server, prefix the key in authorized_keys with options that limit it:

from="198.51.100.0/24",no-port-forwarding,no-agent-forwarding,no-pty ssh-ed25519 AAAA... ci-deploy

• from= accepts the key only from the given range (an example here).
• no-pty and the forwarding options stop interactive use.
• command="..." can force one specific command, such as a deploy script.

Store the private key in your CI system's secret store, never in the repository. If the CI system is ever compromised, removing one line from authorized_keys cuts it off.

12. Check the server's host key

The fingerprint prompt on the first connection protects you against connecting to the wrong machine. For servers that matter, compare it with the real one. In the browser console of the server, run:

ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub

If it matches what your SSH client showed, answer yes. The fingerprint is then stored in ~/.ssh/known_hosts and checked on every later connection.

Troubleshooting

Run ssh -v user@host for a detailed log of what the client tries. If you are fully locked out of a Wolkra server, open the browser console from the server view or boot into rescue mode.

Next: work through the first steps on a new VPS.