Creating SSH keys

Before you rent a server, you first create your key. You’ll use it to log into your VPS: safer than a password and faster, because there’s nothing to type.

After this lesson you have: an SSH key pair on your computer, and you know which part you may share and which part never.

How it works (in one picture)

An SSH key consists of two files that belong together:

flowchart LR
  A["🔑 Private key<br/>id_ed25519<br/>(stays on your computer)"] -- proves who you are --> S[("🖥️ Server")]
  B["🔓 Public key<br/>id_ed25519.pub<br/>(fine to put anywhere)"] -- lives on --> S

Think of the public key as a lock you put on your server’s door, and the private key as the only key that fits that lock.

Security

• Never share your private key (id_ed25519, without .pub): not in a chat, not with an AI assistant, not in a repo or .env. Whoever has that file can log into all your servers.
• Keep coding agents away from ~/.ssh, and use a separate key for automated deploys.
• Don’t use agent forwarding (ssh -A) by default. A hacked server can then use your key while you’re connected.
• Adding a key ≠ password login off. You turn that off in hardening your server.

Step by step

1. Open a terminal.

   macOS
   Open Terminal (Cmd + Space → type “Terminal”).
   Windows
   Open PowerShell (Start → type “PowerShell”). OpenSSH ships with Windows 10 and 11.
   Linux
   Open your terminal (often Ctrl + Alt + T).

2. Check whether you already have a key.

   macOS

   ls ~/.ssh

   Windows

   ls $env:USERPROFILE\.ssh

   Linux

   ls ~/.ssh

   See id_ed25519 and id_ed25519.pub? Then you already have one — skip to step 5. No passphrase on it yet? Add one with ssh-keygen -p (enter the path to your id_ed25519 when asked). Getting an error or an empty folder? Just carry on.

3. Create the key pair. Replace the email address with yours (it’s just a label).

   ssh-keygen -t ed25519 -C "you@example.com"

   When asked where to save the file, just press Enter (the default location is fine).

4. Choose a passphrase. Don’t leave it empty: it protects your key if someone gets hold of your laptop (or the file). Nothing appears while you type — that’s expected.

   What you should see now

   Generating public/private ed25519 key pair.
   Enter file in which to save the key (/Users/you/.ssh/id_ed25519):
   Enter passphrase (empty for no passphrase):
   Enter same passphrase again:
   Your identification has been saved in /Users/you/.ssh/id_ed25519
   Your public key has been saved in /Users/you/.ssh/id_ed25519.pub
   The key fingerprint is:
   SHA256:… you@example.com

5. View your public key. You’ll copy this to your VPS provider later.

   macOS

   cat ~/.ssh/id_ed25519.pub

   Windows

   Get-Content $env:USERPROFILE\.ssh\id_ed25519.pub

   Linux

   cat ~/.ssh/id_ed25519.pub

   What you should see now

   ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA… you@example.com

   One line, starting with ssh-ed25519. That’s what you share.

6. Let your computer remember the passphrase (optional, saves typing).

   macOS

   ssh-add --apple-use-keychain ~/.ssh/id_ed25519

   Windows

   In PowerShell as administrator:

   Get-Service ssh-agent | Set-Service -StartupType Automatic
   Start-Service ssh-agent
   ssh-add $env:USERPROFILE\.ssh\id_ed25519

   Linux

   eval "$(ssh-agent -s)"
   ssh-add ~/.ssh/id_ed25519

Pro tip

Why ed25519 and not RSA? Ed25519 keys are shorter, faster and at least as secure. Only very old systems don’t support them — you won’t meet those on a modern VPS.

Pitfall

Copied the wrong thing? Always check you’re using the file ending in .pub. If the text starts with -----BEGIN OPENSSH PRIVATE KEY-----, you’ve grabbed the private key: don’t paste it, try again.

Cost

Free. SSH ships with macOS, Windows 10/11 and virtually every Linux.

Checklist

0/4

• I opened a terminal
• I created an ed25519 key pair (with a passphrase)
• I know where my .pub file is and how to show it
• I know I never share the private key

Your progress is only stored in this browser.

Test yourself

1. 1Which file may you give to your VPS provider?

   id_ed25519id_ed25519.pubBoth

2. 2Why set a passphrase?

   It is mandatorySo a stolen laptop does not immediately give access to your serversIt makes the key faster

3. 3Nothing appears while you type your passphrase. Now what?

   Restart the terminalKeep typing and press Enter — that is expectedPick another key type

Next lesson: renting a VPS from an EU provider and adding this key straight away.