How to Generate SSH Keys on Windows, Mac & Linux

This guide walks you through generating SSH keys on Windows, macOS, and Linux. SSH keys provide a secure way to authenticate with remote servers and services like GitHub, GitLab, or your own cloud VPS. By the end, you’ll have a public and private key pair, ready to use for passwordless logins.

What You’ll Need

A computer running Windows 10/11, macOS, or a modern Linux distribution.
Command-line access: PowerShell or Command Prompt on Windows, Terminal on macOS/Linux.
For Windows, OpenSSH client is included by default on Windows 10 1809+ and Windows 11. If you have an older version, you may need to enable it via Settings > Apps > Optional Features.
No administrative rights are required for generating keys, but you may need them to install OpenSSH if missing.

Step-by-Step

Open your terminal. On Windows, press Win and type “PowerShell” or “Command Prompt” and open it. On macOS, go to Applications > Utilities > Terminal. On Linux, open your terminal emulator (Ctrl+Alt+T usually works).
Check if SSH is available. Type ssh -V and press Enter. You should see a version number like “OpenSSH_9.0”. If you get “command not found”, you’ll need to install OpenSSH first (see Troubleshooting).
Generate the key pair. Run the following command (replace your email with your actual email address):
ssh-keygen -t ed25519 -C "your_email@example.com"
Using the Ed25519 algorithm is recommended for its security and speed. If you need compatibility with older systems, use ssh-keygen -t rsa -b 4096 -C "your_email@example.com" instead.
Choose a save location. When prompted “Enter file in which to save the key”, press Enter to accept the default location (~/.ssh/id_ed25519 on macOS/Linux, or C:\Users\YourName\.ssh\id_ed25519 on Windows). If you already have a key there, type a different filename like id_ed25519_github to avoid overwriting.
Set a passphrase. You’ll be asked to enter a passphrase. This is an extra layer of security. Type a strong passphrase or press Enter for no passphrase (not recommended for production). You’ll be asked to confirm it.
Verify the key was created. After the command finishes, you’ll see a randomart image and the key fingerprint. To confirm, list the files: ls -la ~/.ssh (macOS/Linux) or dir %USERPROFILE%\.ssh (Windows). You should see two files: the private key (e.g., id_ed25519) and the public key (e.g., id_ed25519.pub).
Copy your public key. You’ll need this to add to a server or service. Run:
cat ~/.ssh/id_ed25519.pub (macOS/Linux) or type %USERPROFILE%\.ssh\id_ed25519.pub (Windows). Select and copy the entire output, which starts with “ssh-ed25519 AAAA…”.
Add the key to your SSH agent (optional but recommended). The agent stores your passphrase so you don’t have to type it every time. Start the agent and add your key:
macOS/Linux: eval "$(ssh-agent -s)" then ssh-add ~/.ssh/id_ed25519
Windows PowerShell: Start-Service ssh-agent then ssh-add $env:USERPROFILE\.ssh\id_ed25519
Use your key. Paste the public key into the appropriate field on GitHub, GitLab, or your server’s ~/.ssh/authorized_keys file. Then test the connection with ssh -T git@github.com (or your server’s address).

Common Mistakes

Overwriting an existing key. If you already have a key and you press Enter at the file prompt, you’ll overwrite it. Always check if a key exists first by listing the .ssh directory.
Copying the private key instead of the public key. The public key ends with .pub. Never share your private key (the one without extension).
Using the wrong email or comment. The -C flag is just a comment; it doesn’t affect functionality, but it helps identify the key. Use a consistent email.
Forgetting the passphrase. If you set a passphrase and forget it, you cannot recover it—you’ll have to generate a new key.
Permissions too open on Linux/macOS. Your private key file must not be accessible by others. If you get “bad permissions” errors, run chmod 600 ~/.ssh/id_ed25519.

Tips

Use a passphrase. Even if your key is stolen, the passphrase makes it useless without it.
Use different keys for different services (e.g., one for GitHub, one for your server). Name them accordingly.
Back up your .ssh directory to a secure location (like a password manager) so you don’t lose access.
On Windows, you can also use the Windows Subsystem for Linux (WSL) to follow the Linux steps if you prefer.
If you’re using a YubiKey or similar hardware token, you can store your SSH key on it, but that’s beyond this guide.

Troubleshooting

Command not found. If ssh-keygen is not recognized, install OpenSSH. On Windows, go to Settings > Apps > Optional Features > Add a feature, search for “OpenSSH Client”, and install it. On macOS, it’s usually preinstalled; if not, install Xcode Command Line Tools with xcode-select --install. On Linux, use your package manager: sudo apt install openssh-client (Debian/Ubuntu) or sudo dnf install openssh-clients (Fedora).
Permission denied when connecting. This usually means the public key isn’t correctly added to the server, or the server doesn’t allow key authentication. Double-check that you copied the entire public key (it starts with ssh-ed25519 or ssh-rsa) and that it’s on one line in the authorized_keys file.
“Bad permissions” on the private key. On macOS/Linux, run chmod 600 ~/.ssh/id_ed25519 and chmod 700 ~/.ssh. On Windows, right-click the file > Properties > Security, and ensure only your user has full control.
Key not being used. If SSH still asks for a password, your SSH client may not be using the key. Check the verbose output with ssh -v user@host to see if your key is being offered. If not, specify the key explicitly with ssh -i ~/.ssh/id_ed25519 user@host.
Passphrase prompt every time. If you added the key to the agent but still get prompted, the agent may not be running. On Windows, ensure the ssh-agent service is set to start automatically (Services > OpenSSH Authentication Agent > Startup Type: Automatic). On macOS/Linux, check with ssh-add -l to see if your key is listed.

Frequently Asked Questions

What is the difference between RSA and Ed25519?

Ed25519 is a modern elliptic-curve algorithm that is faster and more secure than RSA for the same key size. RSA 4096-bit is still widely supported, but Ed25519 is the recommended default for new keys.

Can I use the same SSH key on multiple computers?

Yes, you can copy your private key to other machines, but it’s safer to generate a separate key per device and add each public key to the server. That way, you can revoke one without affecting others.

What is the passphrase for?

The passphrase encrypts your private key on disk. Without it, anyone who gets your private key file can use it. With it, they’d need the passphrase too. It’s like a second password.

How do I change my passphrase?

Run ssh-keygen -p -f ~/.ssh/id_ed25519 and follow the prompts. You’ll need to enter the current passphrase, then a new one.

What if I lose my private key?

You can’t recover it. Generate a new key pair and add the new public key to all servers and services. Remove the old public key from those places to keep things secure.

Is it safe to share my public key?

Yes, public keys are meant to be shared. They can only be used to encrypt data or verify signatures, not to impersonate you. The private key must remain secret.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →