WardtermSSH client
EN
Download

How to use the same SSH keys on several computers

The usual advice is one key per device: run ssh-keygen -t ed25519 on each computer and add each public key to ~/.ssh/authorized_keys on your servers. A lost laptop then costs one line to remove. Copying a single private key to every device also works, if it has a passphrase, travels encrypted and gets mode 600, but when one device is lost you must replace the key everywhere.

Updated . Key creation, adding a second public key over an existing login, listing fingerprints, removing one device by its comment, changing a passphrase and checking a key pair with ssh-keygen -y all run with OpenSSH 10.0 on Debian 13, client and server in a throwaway container.

Two ways to do it

Every device that connects with a key needs a private key on it. You can give each device its own key, or copy the same key to all of them.

One key per deviceOne key copied
SetupAdd each new public key to each serverCopy one file to each device
Device lost or soldRemove one line on each serverNew key on every device and every server
Server logsShow which device logged inAll logins look the same
Hardware keys and phonesWork, since the key never has to moveNot possible when the key cannot be exported

One key per device is the safer default and the one most teams use. Copying makes sense for a few devices you fully control, where adding keys to many servers is the bigger chore.

Create a key on the new device

On the new computer, create a key and give it a comment that names the device:

ssh-keygen -t ed25519 -C "me@desktop"

Accept the default file, ~/.ssh/id_ed25519, and set a passphrase. The comment shows up next to the key in authorized_keys and in fingerprint lists, which is what lets you remove the right line later. The guide to generating an Ed25519 SSH key covers the options.

Add it to your servers

If the server still accepts a password, run this from the new device:

ssh-copy-id -i ~/.ssh/id_ed25519.pub deploy@server

If password login is off, which is the better setup, use a device that can already log in. Bring it the new .pub file (it is public, so email or a chat message is fine), then append it:

ssh deploy@server "cat >> ~/.ssh/authorized_keys" < desktop.pub

Check that both keys are there, each with its comment:

ssh deploy@server "ssh-keygen -lf ~/.ssh/authorized_keys"
256 SHA256:l1AS4F9VRH90JA6uJuQw7/3uRDzrtMafpkeiO7zel84 me@laptop (ED25519)
256 SHA256:LGklWc72FhPwm7in/sLr3pGRujcSZ6a6z4E97qJGkRE me@desktop (ED25519)

Repeat for each server, and add the key to GitHub or GitLab under the account's SSH keys if you push code from this device. With many servers, a short loop over your host list saves time. The format of the file is in the authorized_keys file explained.

If you copy the key instead

Copy both files, id_ed25519 and id_ed25519.pub, over a channel that is encrypted end to end: an encrypted USB drive, AirDrop, or scp between two machines you own. Avoid email, chat and shared folders, which keep copies. Then, on the new device:

chmod 700 ~/.ssh
chmod 600 ~/.ssh/id_ed25519
chmod 644 ~/.ssh/id_ed25519.pub

Without these permissions ssh refuses the key. If the key has no passphrase, add one now, since it now lives in more places:

ssh-keygen -p -f ~/.ssh/id_ed25519

To check that the private key and the public key belong together, print the public half from the private one and compare:

ssh-keygen -y -f ~/.ssh/id_ed25519
cat ~/.ssh/id_ed25519.pub

Both lines must start with the same key. More on this in getting the public key from a private key.

When a device is lost or replaced

With one key per device, remove that device's line on each server. Back up the file, delete by comment, and list what is left:

sed -i.bak '/ me@desktop$/d' ~/.ssh/authorized_keys
ssh-keygen -lf ~/.ssh/authorized_keys

A comment can be edited by anyone who had access, so for a stolen device search by fingerprint instead, as described in revoking an SSH key. Remove the key from GitHub and similar services too.

With a copied key, the lost device holds the same key as all the others. Create a new key, install it everywhere, remove the old public key from every server and service, and copy the new private key to the devices you still have. Until that is done, the passphrase is the only thing protecting the old one.

Keep the configuration the same everywhere

The private keys differ per device, but ~/.ssh/config can be identical, as long as each device names its key the same way:

Host *
    IdentityFile ~/.ssh/id_ed25519
    IdentitiesOnly yes

Host prod
    HostName 203.0.113.10
    User deploy

The config holds no secrets, so it can live in a dotfiles repository or a sync folder. Keep id_* files without .pub out of it. See ssh config file examples for host patterns, and an SSH key manager with an encrypted vault if you would rather keep keys and servers together.

Questions

Is it OK to copy my SSH private key to another computer?

It works, and OpenSSH does not care where a key was made. The cost is at the end: if any copy leaks or a device is lost, the key must be replaced on every server and on every device that holds it.

Can I put my .ssh folder in Dropbox, iCloud or a dotfiles repository?

Keep config and public keys there if you like, never the private keys. A sync folder or Git history keeps copies you cannot fully delete.

How many keys can authorized_keys hold?

There is no practical limit. Each line is one key, and a comment such as me@laptop at the end tells them apart.

Sources

More in Keys and login

All guides