WardtermSSH client
EN
Download

How to generate an SSH key on Windows

Open PowerShell and run ssh-keygen -t ed25519 -C "you@laptop". Press Enter to accept the default file and type a passphrase. The private key is saved in C:\Users\you\.ssh\id_ed25519 and the public key in id_ed25519.pub next to it. Only the .pub file goes on servers.

Updated .

Generate the key

ssh-keygen -t ed25519 -C "you@laptop"

Press Enter to accept the default file. If a key already exists there, type another name such as C:\Users\you\.ssh\id_ed25519_work instead of overwriting it. The comment after -C is only a label, and it is visible to anyone who sees the public key.

If PowerShell says ssh-keygen is not recognized, the OpenSSH client is missing. Install it from an elevated PowerShell:

Add-WindowsCapability -Online -Name OpenSSH.Client~~~~0.0.1.0

Ed25519 is the right default today. For the differences, see RSA vs ed25519 SSH keys.

Choose a passphrase

The passphrase encrypts the private key file, so a copy of the file is not enough to use it. Set one unless the key is for an unattended job. You can change it later without changing the key:

ssh-keygen -p -f $env:USERPROFILE\.ssh\id_ed25519

Use ssh-agent so you type it once

The agent service is disabled by default. Enable it once, in an elevated PowerShell:

Get-Service ssh-agent | Set-Service -StartupType Automatic
Start-Service ssh-agent

Then, in a normal PowerShell, as your own user:

ssh-add $env:USERPROFILE\.ssh\id_ed25519
ssh-add -l

The second command lists the loaded keys. If ssh-add says it cannot connect to the agent, the service is not running: see Could not open a connection to your authentication agent.

If Git still asks for the passphrase

Git for Windows can use its own bundled SSH, which cannot reach the Windows agent. GitHub's documentation gives this fix:

git config --global core.sshCommand "C:/Windows/System32/OpenSSH/ssh.exe"

Copy the public key

Get-Content $env:USERPROFILE\.ssh\id_ed25519.pub | Set-Clipboard

Now paste it where you need it: on GitHub, or on a server with the PowerShell replacement for ssh-copy-id.

File permissions

ssh refuses a private key that other users can read, with the message UNPROTECTED PRIVATE KEY FILE. Keys generated in your own .ssh folder have the right permissions. The problem usually appears when a key is copied from elsewhere. See the fix for that error.

Back up the key, or do not

The private key file is the only copy. If you lose it you create a new one and replace the public key on each server, which is often simpler than keeping a backup. If you do keep one, keep it encrypted.

One way to do that is an SSH key manager with an encrypted vault.

Questions

Where does ssh-keygen save the key on Windows?

In C:\Users\you\.ssh. id_ed25519 is the private key and id_ed25519.pub the public key. Only the .pub file goes on servers and on GitHub.

Do I need extra software to make an SSH key on Windows?

No. Windows 10 and 11 include the OpenSSH client, so ssh-keygen works in PowerShell. If it is missing, add the OpenSSH.Client capability.

How do I change the passphrase later?

Run ssh-keygen -p -f with the path of the private key. The key itself stays the same, so nothing changes on your servers.

Sources

More in SSH on each system

All guides