What is an SSH key? How it works and how to generate one
An SSH key is a cryptographic key pair used to authenticate your identity when connecting to a server over SSH. You get two files: a private key that stays on your machine and a public key that you put on the server. When you connect, the server uses these two pieces to verify who you are, without ever transmitting a password.
Why use SSH keys instead of passwords?
Password logins have problems. Passwords can be guessed. They can be phished. They can be leaked from password manager breaches. And any server with port 22 open to the internet gets hammered by automated bots trying common passwords around the clock.
SSH keys sidestep all of this. A properly generated key is mathematically infeasible to guess. The private key never leaves your machine during authentication. And you can disable password login entirely, so bots that try to brute-force passwords just get refused.
How it works
SSH key authentication uses public-key cryptography. The two keys are mathematically linked: anything encrypted with the public key can only be decrypted with the private key.
When you connect, the server generates a random challenge and encrypts it using your public key. Your SSH client decrypts it using your private key and sends back a response. The server verifies the response. If it matches, you're authenticated. Your private key never traveled across the network.
Key types
RSA
RSA is the oldest SSH key type and the most widely supported. A 4096-bit RSA key is secure. The downside is that RSA keys are large and operations are slower than newer alternatives.
Ed25519
Ed25519 is based on elliptic curve cryptography. The keys are smaller, operations are faster, and the security level is comparable to a 3000-bit RSA key. It is the recommended choice for anything new.
ssh-keygen -t ed25519 -C "your@email.com"
ECDSA
ECDSA is another elliptic curve option. It is faster than RSA but has some concerns about implementation quality in certain libraries. Ed25519 is generally preferred.
For a deeper comparison, see our RSA vs Ed25519 guide.
Generating your first SSH key
On Linux, macOS, or Windows with OpenSSH installed:
ssh-keygen -t ed25519 -C "your@email.com"
The tool will ask:
- Where to save it: The default (
~/.ssh/id_ed25519) is fine for most situations. - Passphrase: Optional but recommended. A passphrase encrypts your private key file, so if the file is stolen, it cannot be used without the passphrase.
This produces two files:
~/.ssh/id_ed25519— your private key. Keep this safe. Never share it.~/.ssh/id_ed25519.pub— your public key. This is what you put on servers.
Adding your key to a server
ssh-copy-id user@your-server
Or manually:
cat ~/.ssh/id_ed25519.pub >> ~/.ssh/authorized_keys
Set correct permissions on the server:
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys
SSH ignores keys if the permissions are too open.
Using SSH keys with browser-based SSH
SSHDock accepts RSA and Ed25519 private keys in PEM format. Paste the contents of your private key file into the connection form, and SSHDock stores it in your browser's local storage for future connections. The key never leaves your device.