WardtermSSH client
EN
Download

How to generate an ed25519 SSH key

Run ssh-keygen -t ed25519 -C "you@laptop", press Return to accept the default file, and type a passphrase. You get a private key in ~/.ssh/id_ed25519 and a public key in ~/.ssh/id_ed25519.pub. Only the public key goes on a server: install it with ssh-copy-id -i ~/.ssh/id_ed25519.pub user@server, or paste it into GitHub.

Updated . Commands run with OpenSSH 10.3 on macOS and OpenSSH 10.0 on Debian 13, including ssh-copy-id, ssh-add and the key-only login test.

Generate the key

First check whether you already have one with ls ~/.ssh. If id_ed25519.pub is there, skip to installing it.

ssh-keygen -t ed25519 -C "you@laptop"

ssh-keygen asks two questions:

Generating public/private ed25519 key pair.
Enter file in which to save the key (/home/you/.ssh/id_ed25519):
Enter passphrase for "/home/you/.ssh/id_ed25519" (empty for no passphrase):
Enter same passphrase again:

Press Return to accept the default file. If a key already exists there, type a different path such as ~/.ssh/id_ed25519_work instead of overwriting it.

The text after -C is a comment that helps you recognize the key later. Anyone who sees the public key can read it, so do not put anything private in it. Since OpenSSH 9.5, a plain ssh-keygen also makes an Ed25519 key, but -t ed25519 works on every version.

Choose a passphrase

The passphrase encrypts the private key file. Without one, anyone who copies the file can use it. With one, they also need the passphrase. You can add or change it later without changing the key:

ssh-keygen -p -f ~/.ssh/id_ed25519

To avoid typing it at every connection, load the key into ssh-agent, as shown below.

Install the public key on a server

ssh-copy-id -i ~/.ssh/id_ed25519.pub user@server

This signs in with your password once, appends the public key to ~/.ssh/authorized_keys on the server and sets the right permissions. If ssh-copy-id is not available, do the same by hand:

cat ~/.ssh/id_ed25519.pub | ssh user@server 'mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys'

On Windows, PowerShell has no ssh-copy-id, and the key is in your user profile:

type $env:USERPROFILE\.ssh\id_ed25519.pub | ssh user@server "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"

More on this in ssh-copy-id on Windows.

Test it

This command only tries keys, so it succeeds only if the key works:

ssh -o PreferredAuthentications=publickey user@server

Do not test with -o PasswordAuthentication=no alone. If the server allows keyboard-interactive login, it can still ask for your password that way, and you would think the key worked.

If it fails, see Permission denied (publickey).

Copy the public key for GitHub and other services

pbcopy < ~/.ssh/id_ed25519.pub     # macOS
cat ~/.ssh/id_ed25519.pub          # Linux: copy the output

On Windows, run Get-Content $env:USERPROFILE\.ssh\id_ed25519.pub | Set-Clipboard. The public key is one line that starts with ssh-ed25519. If you see -----BEGIN OPENSSH PRIVATE KEY-----, you opened the private key: do not paste it anywhere.

The next steps for GitHub are in how to add an SSH key to GitHub.

Stop typing the passphrase

ssh-agent keeps the unlocked key in memory for your session:

ssh-add ~/.ssh/id_ed25519
ssh-add -l

On a Mac, the passphrase can also stay in the Keychain across restarts: see ssh-agent and the macOS Keychain. If ssh-add answers Could not open a connection to your authentication agent, no agent runs in that shell: see how to fix that error.

Use a key with another name

ssh tries the default names, such as id_ed25519, by itself. For a key saved under another name, pass it once with -i:

ssh -i ~/.ssh/id_ed25519_work user@server

Or name it for that server in ~/.ssh/config, so a plain ssh myserver uses it:

Host myserver
    HostName 203.0.113.10
    User user
    IdentityFile ~/.ssh/id_ed25519_work
    IdentitiesOnly yes

The rest of that file is explained in the ssh config file guide.

Why ed25519

Ed25519 keys are short, fast and supported by every OpenSSH release since 6.5, from 2014. Use RSA only to reach an old system or device that does not know ed25519, and then with at least 3072 bits:

ssh-keygen -t rsa -b 4096 -C "you@laptop"

For a side by side comparison, see RSA vs ed25519 SSH keys.

See a key's fingerprint

ssh-keygen -lf ~/.ssh/id_ed25519.pub

The fingerprint is what you compare to check that two copies of a key are the same, for example the key listed on GitHub and the one on your laptop.

Questions

Where is my SSH key stored?

In the .ssh folder of your home directory: ~/.ssh on macOS and Linux, and the .ssh folder of your user profile on Windows. id_ed25519 is the private key and id_ed25519.pub the public one.

Is ed25519 better than RSA?

For new keys, yes. Ed25519 keys are shorter and faster, and every current OpenSSH supports them. Use RSA with at least 3072 bits only for old systems that do not know ed25519.

Do I need the -o and -a 100 options from older guides?

No. -o is accepted but does nothing now: the OpenSSH key format it asked for is the default since OpenSSH 7.8. -a sets how many rounds protect the passphrase, 16 by default. A higher number slows down anyone guessing it, and makes unlocking the key a little slower for you.

I forgot my passphrase. Can I recover it?

No. There is no way to read or reset it. Generate a new key, install its public key on your servers, and remove the old one from their authorized_keys files.

Can I use the same key on several servers?

Yes. The public key can go on any number of servers. Use separate keys where you want to remove access separately, for example for work and personal servers.

Sources

More in Keys and login

All guides