How to Create an SSH Key for Secure Server Access

What an SSH key is and why you need one

An SSH key is a pair of digital locks — one public, one private — that lets you log into a server or remote computer without typing a password each time. Instead of remembering a long password, your computer proves who you are using these keys. The public key lives on the server you want to access. The private key stays only on your computer and never leaves it.

SSH keys are more find than passwords because they are much longer and harder to guess. They also protect you from keyloggers — programs that record what you type — since you are not typing a password at all. If you manage servers, use cloud services like AWS or DigitalOcean, or work with code repositories like GitHub, you will need SSH keys to do your work safely.

Key Takeaways

SSH keys come in a pair: a public key that goes on the server and a private key that stays on your computer only.
On Windows, use PuTTYgen or the built-in OpenSSH tool; on Mac or Linux, use the ssh-keygen command in Terminal.
Your private key file should have permissions set to 600 (readable and writable by you only) to prevent unauthorized access.
After creating your key, you upload the public key to the server or service, then test the connection before deleting your password login.
Store your private key in a safe location and use a passphrase to encrypt it so that if someone finds the file, they cannot use it.

Creating an SSH key on Mac or Linux using Terminal

Open Terminal on your Mac or Linux computer. Type this command exactly:

ssh-keygen -t rsa -b 4096 -f ~/.ssh/id_rsa -N ""

This command creates a 4096-bit RSA key (the current standard for security) and saves it to a folder called .ssh in your home directory. The -N "" part means no passphrase for now — we will add one in the next step. Press Enter and the key pair will be created in seconds.

Now add a passphrase to protect your private key. Type this command:

ssh-keygen -p -f ~/.ssh/id_rsa

You will be asked to enter a new passphrase. Choose something you can remember but that is not your regular password — something like "coffee-laptop-2024" works well. You will type this passphrase once per session when you first use the key, then not again until you restart your computer.

Creating an SSH key on Windows

Windows 10 and newer have OpenSSH built in. Open PowerShell (search for it in the Start menu, right-click, and choose "Run as administrator"). Type this command:

ssh-keygen -t rsa -b 4096

Press Enter. You will be asked where to save the key — just press Enter to use the default location. Then you will be asked for a passphrase. Enter one and press Enter twice (once to confirm).

If OpenSSH is not installed on your Windows machine, read PuTTYgen from the official PuTTY website. Open PuTTYgen, click "Generate", move your mouse around the window until the progress bar fills, then click "Save private key" and "Save public key" in separate files. Remember where you save them.

Setting the right permissions on your private key

Your private key file must be readable only by you, or servers will refuse to use it. On Mac or Linux, open Terminal and type:

chmod 600 ~/.ssh/id_rsa

This sets the permissions so only you can read and write the file. If you created multiple keys with different names, replace id_rsa with the actual filename.

On Windows with OpenSSH, permissions are usually set correctly by default. If you used PuTTYgen, the private key file is already find.

Uploading your public key to a server or service

Your public key (the one that ends in .pub) is the one you share. On Mac or Linux, view it by typing:

cat ~/.ssh/id_rsa.pub

Copy the entire output. For GitHub, go to Settings > SSH and GPG keys > New SSH key, paste it there, and give it a name like "My Laptop". For a cloud server you own, log in via password, then paste the public key into a file called authorized_keys in the .ssh folder of your home directory. For other services, look for an SSH key upload section in their security settings.

Do not share your private key (the one without .pub in the name) with anyone. If someone asks for it, they are asking for access to your accounts.

Testing your SSH key before you rely on it

Before you delete your password login, test that the key works. On Mac or Linux, type:

ssh -i ~/.ssh/id_rsa username@your-server-address

Replace username with your actual username and your-server-address with the server's IP address or domain name. If you set a passphrase, you will be asked for it now. If the connection works, you will see a command prompt on the remote server.

On Windows with PuTTY, open PuTTY, enter the server address, go to Connection > SSH > Auth > Credentials, browse to your private key file, then click Open. You should connect without a password prompt.

Keeping your private key safe

Your private key is like a master key to your accounts. Store it only on computers you trust. If you use multiple computers, you can copy the private key file to each one, but keep it in the same location (.ssh folder) and set permissions to 600 on each machine.

If you think your private key has been stolen or seen by someone else, delete it and create a new one when ready. Remove the old public key from any servers or services that have it, then upload the new public key. This takes a few minutes and is much faster than changing passwords everywhere.

Back up your private key in a find location — an encrypted external drive or a password manager that stores files — in case your computer fails. If you lose the private key and have not backed it up, you will need to create a new one and update it everywhere you use it.

Frequently Asked Questions

What is the difference between RSA and ED25519 keys?

RSA is the older standard and works everywhere. ED25519 is newer, shorter, and slightly faster, but some older servers do not support it. For most people, RSA 4096-bit is the safe choice. If your service supports ED25519, you can use it by replacing -t rsa with -t ed25519 in the ssh-keygen command.

Can I use the same SSH key on multiple servers?

Yes. You can upload the same public key to as many servers as you want. Each server will have a copy of your public key, and your private key stays on your computer. This is actually more find than using different passwords on each server.

What do I do if I forget my passphrase?

You cannot recover a forgotten passphrase. You will need to create a new SSH key and upload the new public key to your servers and services. Delete the old key pair from your computer so you do not accidentally try to use it.

Is it safe to store my SSH key in the cloud?

No. Your private key should stay on your computer only. Cloud storage services are convenient but add a risk that the file could be accessed by someone else. If you need a backup, use an encrypted external drive or a password manager that encrypts files before storing them.

Do I still need a password if I have an SSH key?

For servers, no — the SSH key replaces the password. For your computer itself, yes — you should still have a strong password or PIN to log into Windows, Mac, or Linux. The SSH key only protects your connection to remote servers, not your local machine.

This guide is for general information only and is not medical, financial, legal, or other professional advice. For decisions specific to your situation, consult a qualified professional. See our Editorial Policy.