iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Use OpenSSH’s ssh-keygen to create an SSH key pair, keep the private key on your device, and give the matching public key to the service or remote account you want to access. For a typical new key, run ssh-keygen -t ed25519 -C "your_email@example.com" in a terminal. Creating the pair is only the local step: for server login, the account must also authorize your public key.
Before you generate a key
Open a terminal where OpenSSH is installed. The command and file behavior below follow OpenBSD’s ssh-keygen(1) manual; your operating system may bundle a different version or modified build, so consult the local ssh-keygen manual if an option behaves differently. OpenBSD-current documents Ed25519 as the default key type when no arguments are supplied, but specifying the type makes the command’s intent explicit.
Generate an Ed25519 key pair
- Run
ssh-keygen -t ed25519 -C "your_email@example.com". Replace the example comment with an identifier that will help you recognize the key later. The comment is metadata, not a password or secret. - When prompted for a file location, press Enter to accept the suggested path, or enter a different path. If a key already exists at that location, do not overwrite it unless you intend to replace it; overwriting can leave services configured for the old public key unable to authenticate with the new pair.
- Enter a passphrase when prompted, then enter it again to confirm. Keep the private-key file readable only by your user account.
The command-line prompts and defaults can vary by OpenSSH version. If you need to check available options on your system, use man ssh-keygen.
Know which file to keep and which to share
OpenSSH saves two related files at the chosen location: the private key at the path you selected, and the public key in the same path with .pub appended. For example, if the private key is ~/.ssh/id_ed25519, the public key is ~/.ssh/id_ed25519.pub. The ssh-keygen(1) manual describes this private/public distinction.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Private key: Keep this file on your device and do not send it to a server, service, or another person. Its passphrase, if set, protects the private portion of the key file.
- Public key: This is the shareable half. Provide the contents of the
.pubfile to the service or account that should accept authentication from your key. The public key itself does not need to be kept secret.
To view a public key in a terminal, use cat ~/.ssh/id_ed25519.pub, adjusting the path if you chose a different filename. Copy the complete public-key line, not the private-key file.
Should you add a passphrase?
A passphrase encrypts the private portion of the key file, adding protection if someone obtains that file. It also means you must enter or otherwise manage the passphrase when the key is used. The OpenBSD ssh-keygen(1) manual warns: “There is no way to recover a lost passphrase.” If you forget it, you need to generate a replacement key pair and install the new public key wherever the old one was authorized.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
An unprotected private key avoids passphrase entry but lacks that added file-level protection. Choose based on your device, workflow, and ability to manage the passphrase; in either case, restrict access to the private-key file.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Authorize the public key for remote login
Generating a key pair does not, by itself, grant access to a server. To use public-key authentication for a remote account, that account must have your public key in ~/.ssh/authorized_keys. The OpenBSD ssh(1) manual describes public-key authentication: the server uses the public key while you retain the corresponding private key.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Install the public-key line in the intended account’s authorized_keys file using an access method you already have, or follow the exact setup instructions provided by your host or developer service. Upload screens and account requirements differ among services, so use the service’s instructions for its own setup. Never substitute your private-key contents when asked for a public key.
Use ssh-agent if you want help managing key use
ssh-agent is optional; it does not generate keys or authorize them on a server. It holds private keys for later public-key authentication and makes them available to SSH through an environment-based socket, as described in the OpenBSD ssh-agent(1) manual. Whether you use an agent depends on your operating system and session setup; follow its local OpenSSH instructions for starting the agent and adding a key.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
When a standard Ed25519 key is not the right fit
Ed25519 is a straightforward software-generated choice for the general walkthrough, but compatibility requirements can differ. OpenSSH also supports FIDO authenticator-backed key types. These are optional and require the authenticator to be available when the key is used; consult the OpenBSD-current ssh-keygen(1) manual and the requirements of the system or service you need to access before choosing one.
Quick Recap
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
