What Is an SSH Key?
Author: Domeny.ForSale editorial team Published
In brief: An SSH key verifies your identity when you connect securely to a server or service, such as a code repository. In practice, you use a pair: a public key, which you give to the service, and a private key, which stays on your device. This type of login can replace your account password, but you must protect the private key.
How does SSH key login work?
SSH, short for Secure Shell, is a protocol that enables secure communication with another computer over a network. It is used for tasks such as managing servers, transferring files via SFTP, and communicating with Git repositories. An SSH connection is encrypted whether you log in with a password or a key — the key primarily changes how your identity is verified.
A key pair consists of two mathematically related components:
- Public key allows the server or service to check whether the person connecting has the corresponding private key. You place it on the server or in the service’s settings.
- Private key is used to create cryptographic signatures that confirm your identity. You do not send it to an administrator or paste it into a service’s control panel.
During login, the SSH program uses the private key to sign data associated with the connection. The server verifies the signature using the stored public key. The private key itself is not sent to the server, and reconstructing it from the public key is practically impossible when a suitable modern algorithm is used.
When is an SSH key useful instead of a password?
If you administer a VPS, or virtual private server, you can log in with a key instead of entering the account password. When working with Git, a key can verify your identity when you pull and push changes. However, this does not automatically mean that your commits are signed — that is a separate feature that requires configuration.
For example, two people maintain a company website. Instead of sharing one password, each creates their own key pair, and the administrator adds their public keys to the appropriate accounts. When one person stops working with the company, their key can be removed without replacing the other person’s key. Separate system accounts also make it easier to assign different permissions.
Keys reduce the risk of a password being guessed through automated login attempts. They do not protect against everything, however: a compromised device or an unprotected private key can give an attacker access. Simply adding a key does not disable password login on the server either.
How do you create an SSH key pair?
On a system with OpenSSH installed, open a terminal. First, check the .ssh directory in your home directory so that you do not overwrite existing keys. You can create a new pair using the modern Ed25519 algorithm with this command:
ssh-keygen -t ed25519 -C "work-laptop"
The -C option adds a comment to help identify the key; it does not grant permissions. The program will ask where to save the key and for a key passphrase. This passphrase protects the private key file and is not the password for your account on the server. Older or specialised environments may require a different algorithm — check your provider’s requirements.
With the default filename, two files will be created:
~/.ssh/id_ed25519— the private key; keep it exclusively under your control.~/.ssh/id_ed25519.pub— the public key; you add its contents to the service.
The ~ symbol denotes the user’s home directory. A public key usually takes the form of one long line beginning with ssh-ed25519. Copy the entire line into the SSH keys field in your provider’s control panel. On an OpenSSH server, it is usually appended to the appropriate account’s ~/.ssh/authorized_keys file, without removing existing entries. The directory and file permissions on the server must also be set correctly.
After adding the key, test the connection:
ssh -i ~/.ssh/id_ed25519 username@server-address
Replace the username and address with your own details. If you are changing the access configuration, keep your current session open until you have successfully logged in through a second window.
User keys versus server keys
When you connect for the first time, SSH may display the server key’s fingerprint, a shortened identifier for that key. This is not your user key: it is used to confirm that you are connecting to the correct machine. Compare the fingerprint with information obtained through an independent, trusted channel, such as from the administrator or your provider’s control panel.
Do not ignore warnings that the server key has changed. The cause may be a legitimate reinstallation, but it could also be someone impersonating the server. First establish why it has changed, rather than deleting the entry without checking from the known_hosts file, where the SSH client keeps a record of recognised servers.
How do you store a key securely and revoke it?
Protect your private key with a strong passphrase, and do not put it in a repository, message, or support ticket. An SSH agent is a program that can hold an unlocked key in memory and use it for signing, reducing the need to re-enter the passphrase.
Separate keys for different devices make it easier to revoke access if one of them is lost. If you suspect a leak, remove the corresponding public key from all servers and services that accept it, then generate a new pair. Changing the passphrase on the local file does not invalidate a stolen copy.
Before you start using a new key, check the service’s control panel to find out how to remove it and how to regain access if you lose your device. This way, a laptop failure will not cut you off from your only way of managing the server.
Read also
