How to Generate SSH Keys on Linux with ssh-keygen

Secure Shell (SSH) is a network protocol for creating a secure connection between a client and a server. With SSH, you can run commands on remote machines, create tunnels, forward ports, and more.

SSH provides multiple authentication mechanisms. The two most common authentication methods are password-based and public-key-based. Public-key authentication is more secure and convenient than traditional password authentication.

This guide shows you how to create SSH keys on Linux with ssh-keygen, which key type to pick, and where to install the public key once you have it.

Quick Reference #

Prerequisites #

Before you begin, make sure you have:

• A Linux system with an SSH client installed (included by default on most distributions)
• Somewhere to install the public key, such as a remote server, a Git hosting account, or a cloud provider

Check for Existing SSH Keys #

Before generating a new key pair, check if you already have SSH keys on your system:

ls -l ~/.ssh/id_*.pub

If you see files like id_rsa.pub or id_ed25519.pub, you already have SSH keys. You can either use the existing keys or generate new ones. Generating a new key pair with the same name will overwrite the old one.

If the command returns No such file or directory, you don’t have SSH keys and may proceed with generating a new pair.

Generate an SSH Key Pair #

The ssh-keygen command creates a new SSH key pair. You can choose between different key types:

• Ed25519 (recommended) - Modern, secure, and fast
• RSA - Widely compatible, use 4096 bits for security

Generate an Ed25519 Key (Recommended) #

Ed25519 keys are shorter, faster, and considered more secure than RSA keys:

ssh-keygen -t ed25519 -C "your_email@example.com"

Generate an RSA Key #

If you need compatibility with legacy systems that don’t support Ed25519, use RSA with 4096 bits:

ssh-keygen -t rsa -b 4096 -C "your_email@example.com"

The -C flag adds a comment (usually your email) to help identify the key.

Key Generation Process #

After running the command, you’ll be prompted to specify the file location:

Enter file in which to save the key (/home/username/.ssh/id_ed25519):

Press Enter to accept the default location, or specify a custom path.

Next, you’ll be prompted to enter a passphrase:

Enter passphrase (empty for no passphrase):

A passphrase adds another layer of security. If someone gets your private key, they’ll still need the passphrase to use it. Keep in mind, you’ll have to enter the passphrase each time you use the key unless you use an SSH agent.

Press Enter for no passphrase, or type a secure passphrase and confirm it.

The output will look similar to this:

Your identification has been saved in /home/username/.ssh/id_ed25519
Your public key has been saved in /home/username/.ssh/id_ed25519.pub
The key fingerprint is:
SHA256:AbCdEf1234567890AbCdEf1234567890AbCdEf12 your_email@example.com

The command creates two files:

• ~/.ssh/id_ed25519 - Your private key (keep this secret)
• ~/.ssh/id_ed25519.pub - Your public key (safe to share)

Where to Put Your Public Key #

Generating a key pair is only half the job. The public key (id_ed25519.pub) has to be installed wherever you want to authenticate, and the method depends on the destination. The private key never leaves your machine.

A Linux server you control. Install the key in the remote account’s authorized_keys file with ssh-copy-id:

ssh-copy-id username@server_ip

You will be prompted for the remote user password once. After that the key is in place and the password prompts stop. Our guide on passwordless SSH login covers the full flow, including the manual copy method and how to disable password authentication afterwards.

GitHub, GitLab, or Bitbucket. These hosts have no shell account, so ssh-copy-id does not apply. Print the public key and paste the output into the SSH key settings of your account:

cat ~/.ssh/id_ed25519.pub

ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH8k... your_email@domain.com

Then confirm the key works against the host endpoint. For GitHub:

ssh -T git@github.com

A cloud provider. AWS, DigitalOcean, and Hetzner let you register a public key in the control panel and inject it into new instances at creation time. Paste the same output into the provider key form before launching the machine, and it lands in the default user’s authorized_keys automatically.

Using the SSH Agent #

If you set a passphrase on your key, entering it for every connection can be tedious. The SSH agent stores your decrypted private key in memory, so you only need to enter the passphrase once per session.

Start the SSH agent:

eval "$(ssh-agent -s)"

Agent pid 12345

Add your private key to the agent:

ssh-add ~/.ssh/id_ed25519

You’ll be prompted for your passphrase. After entering it, subsequent SSH connections will use the cached key without asking for the passphrase again.

To list keys currently loaded in the agent:

ssh-add -l

Managing SSH Keys #

View Your Public Key #

To display your public key (useful for adding to services like GitHub):

cat ~/.ssh/id_ed25519.pub

List All Keys #

To see all key files in your SSH directory:

ls -la ~/.ssh/

Remove a Key from the Agent #

To remove a specific key from the SSH agent:

ssh-add -d ~/.ssh/id_ed25519

To remove all keys from the agent:

ssh-add -D

Delete a Key Pair #

To permanently delete a key pair, remove both the private and public key files:

rm ~/.ssh/id_ed25519 ~/.ssh/id_ed25519.pub

Troubleshooting #

Permission Denied (publickey) #

If you see this error, check the following:

1. Verify the public key is in the remote server’s ~/.ssh/authorized_keys:

   Terminal

   cat ~/.ssh/authorized_keys

2. Check permissions on the remote server:

   Terminal

   chmod 700 ~/.ssh
   chmod 600 ~/.ssh/authorized_keys

3. Ensure the private key has correct permissions locally:

   Terminal

   chmod 600 ~/.ssh/id_ed25519

SSH Agent Not Running #

If you get an error about the agent, start it with:

eval "$(ssh-agent -s)"

Wrong Key Being Used #

To specify which key to use for a connection:

ssh -i ~/.ssh/my_custom_key username@server_ip

For permanent configuration, add an entry to ~/.ssh/config:

Host myserver
    HostName server_ip
    User username
    IdentityFile ~/.ssh/my_custom_key

Then connect using:

ssh myserver

Conclusion #

A single key pair works across every destination that accepts one, so generating a good key once and keeping the private half safe matters more than repeating the process per host.

To keep your SSH connections organized, check out our guide on using the SSH config file . You can also change the default SSH port for extra security. If a key stops working after you copy files to a new machine or restore a backup, our guide to the files and permissions in the ~/.ssh folder shows what each file should contain and the mode it needs.

If you have questions or feedback, feel free to leave a comment.

About the authors

Dejan Panovski

Dejan Panovski is the founder of Linuxize, an RHCSA-certified Linux system administrator and DevOps engineer based in Skopje, Macedonia. Author of 800+ Linux tutorials with 20+ years of experience turning complex Linux tasks into clear, reliable guides.

View author page