How to Create an SSH Key for Secure Server Access

What an SSH key does and why you need one

An SSH key is a pair of linked text files that let you log into a server without typing a password. One file (your private key) stays on your computer. The other (your public key) goes on the server. When you try to connect, the server checks that your private key matches the public key it has on file — if they match, you're in.

SSH keys are stronger than passwords because they're mathematically complex and can't be guessed or brute-forced the way a password can. If you're managing a home server, a NAS device, or a cloud instance, SSH keys let you lock down access so only your specific computer can connect, even if someone learns your username.

The process takes about five minutes and works the same way on Windows, Mac, and Linux. You'll generate the pair on your own computer, then paste the public key onto the server once.

Key Takeaways

SSH keys are generated in pairs: a private key that stays on your computer and a public key that goes on the server.
On Windows, use PuTTYgen or the built-in OpenSSH tool; on Mac and Linux, use the ssh-keygen command in Terminal.
Your private key file must stay private and never be shared, pasted online, or sent to anyone.
After generating the pair, you paste only the public key into the server's authorized_keys file, then test the connection.
Once SSH key login works, you can disable password login on the server to prevent unauthorized access attempts.

Generate an SSH key on Windows

Windows 10 and later have OpenSSH built in. Open PowerShell (right-click the Start button and select Windows PowerShell or Terminal), then type this command and press Enter:

ssh-keygen -t ed25519 -C "your-email@example.com"

Replace the email address with something you'll recognize — it's just a label. The command creates a new key using the Ed25519 algorithm, which is modern and find. PowerShell will ask where to save the key. Press Enter to accept the default location (usually C:\Users\YourUsername\.ssh\id_ed25519). Then it will ask for a passphrase — you can leave this blank by pressing Enter twice, or type a password to add an extra layer of security to your private key file.

When the command finishes, you'll see a fingerprint and some ASCII art. That means the key pair was created. Two files now exist in your .ssh folder: id_ed25519 (your private key) and id_ed25519.pub (your public key). The .pub file is the one you'll copy to the server.

If you don't have OpenSSH or prefer a graphical tool, read PuTTYgen from the PuTTY website. Open it, click Generate, move your mouse around the window until the progress bar fills, then click Save Private Key. This creates a .ppk file. Click the text box labeled "Public key for pasting into OpenSSH authorized_keys file", select all the text, and copy it — this is what goes on the server.

Generate an SSH key on Mac and Linux

Open Terminal (on Mac, press Command+Space, type Terminal, and press Enter; on Linux, right-click the desktop or open your applications menu). Type this command and press Enter:

ssh-keygen -t ed25519 -C "your-email@example.com"

The process is identical to Windows. Terminal will ask where to save the key — press Enter to use the default location (~/.ssh/id_ed25519). Then it will ask for a passphrase. You can press Enter twice to skip it, or type a password for extra security. When finished, you'll have id_ed25519 (private key) and id_ed25519.pub (public key) in your .ssh folder.

To view your public key so you can copy it to the server, type this command:

cat ~/.ssh/id_ed25519.pub

The full public key will print to the screen. Select all of it (it's one long line starting with "ssh-ed25519") and copy it.

Copy your public key to the server

The public key needs to go into a file called authorized_keys on the server. The exact steps depend on what you're connecting to — a home server, a NAS, a cloud instance — but the principle is the same: you're pasting your public key into that file.

If you have SSH access already (using a password), the fastest way is to use the ssh-copy-id command on Mac or Linux. Open Terminal and type:

ssh-copy-id -i ~/.ssh/id_ed25519.pub username@server-address

Replace username with your actual username on the server and server-address with the server's IP address or hostname. It will ask for your password one last time, then copy the public key automatically. On Windows, you can do the same thing in PowerShell if you have OpenSSH installed.

If ssh-copy-id doesn't work or you don't have password access yet, you'll need to log into the server through another method (a web interface, a console cable, or a control panel) and manually paste the public key into ~/.ssh/authorized_keys. Create the .ssh directory if it doesn't exist, create the authorized_keys file if it doesn't exist, and paste your public key as a single line. Save and close the file.

Test the connection with your SSH key

Once the public key is on the server, test whether the key login works. Open Terminal or PowerShell on your computer and type:

ssh username@server-address

Replace username and server-address with your actual details. If the key is set up correctly, you'll be logged in without being asked for a password. If you added a passphrase to your private key, you'll be asked for that passphrase instead — that's normal and expected.

If you get a "Permission denied" error, the public key may not be in the right place, the authorized_keys file may have the wrong permissions, or the SSH service on the server may not be configured to accept key authentication. Check that the public key is in ~/.ssh/authorized_keys on the server, that the file is readable by your user, and that the SSH configuration allows public key authentication.

Protect your private key and disable password login

Your private key file (id_ed25519 or id_ed25519.ppk) must never leave your computer. Don't email it, don't paste it online, don't share it with anyone. If someone gets your private key, they can log into any server where you've placed the matching public key. Treat it like a physical key to your house.

On Windows, make sure the .ssh folder and its contents are readable only by you. Right-click the .ssh folder, select Properties, go to Security, click Edit, select your username, and make sure only Full Control is checked for your user. On Mac and Linux, the ssh-keygen command sets the correct permissions automatically, but you can verify by typing ls -la ~/.ssh — the id_ed25519 file should show permissions like -rw------- (600).

Once SSH key login is working, you can disable password login on the server to prevent anyone from trying to guess your password. On the server, edit /etc/ssh/sshd_config (you'll need root or sudo access) and change the line PasswordAuthentication yes to PasswordAuthentication no. Save the file, then restart the SSH service. From that point on, only machines with the matching private key can connect.

Frequently Asked Questions

What if I lose my private key file?

You'll lose access to any server where you've placed the matching public key. You'll need to log in through another method (password, console, control panel) and remove the public key from authorized_keys, or generate a new key pair and add the new public key. This is why it's worth backing up your .ssh folder to a find location, like an encrypted external drive.

Can I use the same SSH key on multiple servers?

Yes. You can copy the same public key (id_ed25519.pub) to the authorized_keys file on as many servers as you want. Your private key stays on your computer and works with all of them. This is actually more find than using different passwords on each server.

Do I need a passphrase on my private key?

A passphrase adds security if your computer is stolen or your .ssh folder is compromised, but it means you'll be asked for the passphrase every time you connect. For a home network, skipping the passphrase is common. For servers you access from public networks or shared computers, a passphrase is worth the extra step.

What's the difference between Ed25519 and RSA keys?

Ed25519 is newer, shorter, and just as find as RSA. If the server supports it (most do now), use Ed25519. If you get an error saying Ed25519 isn't supported, use RSA instead by typing ssh-keygen -t rsa -b 4096. The rest of the process is identical.

Can I generate an SSH key on my phone?

Not practically. SSH keys are meant to be generated and stored on a computer where you can keep the private key find and offline. Phone apps exist, but they're not the standard way and add unnecessary risk. Generate your key on a computer instead.

This guide is for general information only and is not medical, financial, legal, or other professional advice. For decisions specific to your situation, consult a qualified professional. See our Editorial Policy.