How to set up SSH key authentication and stop using passwords

A password can be guessed, reused, leaked or phished. An SSH key cannot be guessed in any practical sense. Switching from passwords to keys is the single best thing you can do for a server's login security, and once it is set up, logging in is also faster, because you stop typing passwords.

How keys work

You create a pair of files:

  • A private key, which stays on your computer and is never shared.
  • A public key, which you put on every server you want to log in to.

When you connect, the server uses the public key to challenge your computer, and only the matching private key can answer. The secret never crosses the network. That is why a stolen password list is useless against key-only servers.

Step 1: create a key pair

On your own computer, in a terminal (macOS, Linux, or Windows PowerShell):

ssh-keygen -t ed25519 -C "my laptop"

Ed25519 is a modern, short and strong key type. The comment, after -C, is just a label that helps you recognise it later.

It asks where to save the key. The default is fine. It then asks for a passphrase. Set one. A passphrase encrypts the private key file, so that if the file is stolen, it is still protected. Your computer's SSH agent can remember it for a session so you do not type it every time.

You now have two files in the .ssh folder of your home directory: id_ed25519 (private) and id_ed25519.pub (public). Never share or upload the one without .pub.

Step 2: put the public key on the server

The easiest way on macOS and Linux:

ssh-copy-id alex@YOUR_SERVER_IP

It logs in with your password one last time and adds the key. On Windows, where that command is not always present, paste the public key manually. Log in with your password, then run:

mkdir -p ~/.ssh
nano ~/.ssh/authorized_keys

Paste the entire contents of your .pub file as a single line, and save. Then set the permissions, which SSH insists on:

chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

If the permissions are too open, SSH quietly ignores the file, and you keep getting the password prompt. That is the most common reason a key "does not work".

Step 3: test it

Open a new terminal and connect:

ssh alex@YOUR_SERVER_IP

If it asks for your key passphrase, not the account password, it worked. If it still asks for the account password, something is wrong. Add -v to the command for verbose output that shows which keys it tried.

Do not close your original session until this works.

Step 4: turn passwords off

Only after the key works, tell the server to refuse passwords. See How to harden your SSH configuration. This is what actually removes the risk, because a server that still accepts passwords is only as safe as its weakest one.

Using several keys and servers

If you manage many machines, a file called ~/.ssh/config saves typing:

Host myserver
    HostName 203.0.113.10
    User alex
    IdentityFile ~/.ssh/id_ed25519

Then ssh myserver is all you need. Use a separate key for different purposes, for example one for work and one for personal servers, so you can revoke one without affecting the rest.

Adding a second key

For another computer, create a fresh key pair on that machine, and add its public key as a new line in authorized_keys. Do not copy your private key between computers. If a laptop is lost, you remove its line from authorized_keys, and it can no longer get in.

If you lose your key

You cannot recover a lost private key. You need another way in: a different key already on the server, your provider's web console, or a rescue mode. That is why it is wise to keep a backup of your private key in a password manager or an encrypted drive, and to have a second key registered. The Connect to your VPS over SSH guide covers the basics of connecting, and your provider's console is the safety net.

Security habits

  • Protect the private key with a passphrase.
  • Keep permissions tight, with chmod 600 on the private key.
  • Do not paste a private key anywhere, including support chats.
  • Remove old public keys from authorized_keys when people leave.
  • Pair this with a firewall and the other steps in Basic security for a new VPS.

And as a general rule for accounts, add two-factor authentication where it is offered. See Enable two-factor authentication (2FA) and passkeys.

Still stuck? Open a ticket on Discord - run /ticket in any channel, pick a department, and include your Server ID or Invoice ID so we can jump straight in.