How to Generate SSH Key on Linux, Windows & macOS?

SSH keys offer a safer, faster way to prove your identity. Instead of typing a password every time, you use a pair of cryptographic keys. This guide shows exactly how to generate an SSH key on Linux, macOS, and Windows. Whether you are setting up a new web server for your online store, connecting to a GitHub repository, or writing scripts that move files between machines, you will have a secure keypair ready in minutes.

What Is an SSH Key?

An SSH key is a pair of cryptographic text strings: a private key you guard like a house key, and a public key you share with the servers you want to access. Think of the public key as a padlock and the private key as the only key that opens it. When you connect, your computer proves it holds the private key without ever sending it across the network. The remote server already knows your public key from a file called authorized_keys. If the mathematical challenge‑response succeeds, you are logged in.

Under the hood, the keys are long strings of random‑looking characters. The private key sits in a file such as ~/.ssh/id_ed25519 and must stay protected. The public key ends with .pub and can be freely distributed. Anyone who gets your public key can lock something for you, but only the private key can unlock it. This simple idea makes brute‑force password attacks useless. If an attacker does not own your private key file, they cannot pretend to be you.

Why Generate an SSH Key?

If you manage even one remote Linux server, an SSH key saves you hours of typing. You will not type your password dozens of times a day. It also makes automated tasks possible. Deployment scripts, backup jobs, and CI/CD pipelines can all use key‑based authentication without storing plain‑text passwords in a script file.

Security is another big reason. Passwords can be guessed, stolen, or phished. An SSH key with a strong passphrase adds a second layer: even if someone grabs the private key file, they still need the passphrase. Think of it like a bank vault that requires both a key card and a PIN. Services like GitHub, GitLab, and Bitbucket require SSH keys for pushing code over a secure channel. E‑commerce sellers who log into cloud servers to update their product catalog or check logs also rely on these keys to keep customer data safe. Generating a fresh key is the first step to locking down your digital infrastructure.

Before you create a new key, check whether you already have one. On Linux or macOS, open a terminal and run ls ~/.ssh/id_*. If you see files like id_rsa or id_ed25519, a keypair exists. You can reuse it, but for sensitive work it is often better to generate a dedicated keypair. Now let’s walk through the process on different platforms.

Method 1: How to Generate SSH Key on Linux/macOS?

Linux and macOS both ship with OpenSSH, true and ready. You do not need to install anything extra. The whole job happens inside the terminal. Open your terminal application first. On Ubuntu or Debian you might press Ctrl+Alt+T; on macOS, launch Terminal from Applications  > Utilities.
We will create an Ed25519 key, today’s gold standard. It is faster and smaller than older RSA keys while offering at least 128 bits of security.

1. Run the following command and press Enter:

ssh-keygen -t ed25519 -C "your_email@example.com"

2. Replace the email with your own address. The email becomes a helpful label inside the public key, visible to anyone who looks at it. If your system runs OpenSSH older than version 6.5 (rare these days), Ed25519 may not be supported. In that case, fall back to RSA with a strong 4096‑bit length:

ssh-keygen -t rsa -b 4096 -C "your_email@example.com"

3. After you press Enter, the utility asks where to save the private key. The default location is ~/.ssh/id_ed25519 (or id_rsa for RSA). Hitting Enter accepts that. If you already have a key with the same name, the tool warns you before overwriting it. Press Ctrl+C to cancel and choose a different file name, or go ahead if you are replacing an old key.

4. It prompts for a passphrase. A passphrase encrypts the private key on your disk. If someone copies the file, they still need the secret phrase to use it. Type a passphrase that you can remember—or press Enter twice for no passphrase (much less secure). Nothing appears on the screen as you type. That is normal and prevents shoulder‑surfing.

5. Once the passphrase step completes, ssh-keygen prints a fingerprint and a whimsical “randomart” image. Your keys are ready. To see your public key, type cat ~/.ssh/id_ed25519.pub. The output is a single line that starts with ssh-ed25519. Copy that entire line and paste it into your server’s ~/.ssh/authorized_keys file, or into the SSH‑key field of services like GitHub.

Note:

Your private key file (~/.ssh/id_ed25519) must be readable only by you. Run chmod 600 ~/.ssh/id_ed25519 if you ever move it or restore it from a backup. The same permission rule applies to the .ssh directory itself: chmod 700 ~/.ssh. These simple commands block other users on the same machine from peeking at your secrets.

When you later connect with ssh user@host, your SSH client automatically offers the key. If the key has a passphrase, you will be asked for it once per session unless you use ssh-agent to cache it. To add the key to the agent, run ssh-add ~/.ssh/id_ed25519 and enter the passphrase once. The agent then handles logins silently until you log out.

Method 2: How to Generate SSH Key on Windows with OpenSSH?

Modern Windows versions (Windows 10 release 1809 and later, plus Windows 11) include the OpenSSH client. It is often installed by default.

To check, open Windows PowerShell > press Win+R > type powershell > hit Enter > run ssh. If you see a usage summary, OpenSSH is ready. If the command is not recognized, go to Settings > Apps > Optional features > Add a feature, search for OpenSSH Client, and install it. No third‑party download is needed.

1. OpenSSH on Windows works almost exactly like its cousins on other platforms. Launch PowerShell again. Type the same command and press Enter:

ssh-keygen -t ed25519 -C "your_email@example.com"

Change the email to your own. For RSA, use ssh-keygen -t rsa -b 4096 -C "your_email@example.com". The tool asks for a file path. The default is C:\Users\YourUsername\.ssh\id_ed25519. Press Enter to accept it, or type a different path if you want to keep multiple keys separate.

2. Next comes the passphrase prompt. Unless you absolutely need a key that never asks for a password, set a strong passphrase. No characters appear while you type. Confirm the passphrase when asked.

3. After the process finishes, your keys live in the C:\Users\YourUsername\.ssh\ folder. To display the public key, run type $env:USERPROFILE\.ssh\id_ed25519.pub in PowerShell. Or if you use Command Prompt, run type %USERPROFILE%\.ssh\id_ed25519.pub. Copy the entire output and install it on your server’s authorized_keys file. For GitHub, paste it into the SSH and GPG keys section of your account settings.

The crucial difference from Linux is the path style. Windows uses backslashes and environment variables like $env:USERPROFILE in PowerShell. Apart from that, the behavior matches exactly. Now you can open a PowerShell window and type ssh user@host. The key will be offered automatically, and you will only need the passphrase once per session if you use the built‑in OpenSSH Agent. Enable the agent with Start-Service ssh-agent and add your key via ssh-add.

Method 3: How to Generate SSH Key on Windows with PuTTYgen?

Not everyone likes the command line. PuTTYgen is a small graphical tool from the PuTTY family that feels familiar and requires no terminal commands.

1. Once PuTTYgen opens, you see a window with a Generate button. At the bottom, select the key type you want. Ed25519 is modern and fast. RSA is the legacy fallback. For RSA, set the number of bits to 4096 in the field below. Then click Generate. The program now asks you to move your mouse randomly inside the blank area above. This wiggle‑and‑hover action creates genuine entropy (unpredictability) that strengthens the key. Keep moving the mouse until the progress bar fills completely.

2. When generation completes, PuTTYgen displays the public key, a string that starts with ssh-ed25519 or ssh-rsa. You can copy this text directly into your server’s authorized_keys file or into a service like GitHub. But before you copy anything, scroll down and set a passphrase. Type a strong passphrase into the Key passphrase and Confirm passphrase fields. If you leave them blank, the saved private key will have no password protection—anyone who gets the file can use it immediately.

3. Click Save private key and choose a location. PuTTYgen warns you if no passphrase is set; you can still proceed, but a passphrase is strongly recommended. The private key is saved with a .ppk extension, a format unique to PuTTY. Never share this file. For the public key, click Save public key to store a text file you can reference later.

Note:

The file saved by Save public key is not in the same one‑line OpenSSH format that servers expect. It has extra headers and line breaks. The correct format for pasting into a remote .ssh/authorized_keys file is the text shown at the top of the PuTTYgen window, right after the key generation finishes. Copy that single‑line text instead of the saved file’s content.

If you later need to convert the PuTTY private key into a standard OpenSSH key (for tools like ssh on Windows Subsystem for Linux or scripts that use ssh-add), PuTTYgen handles that easily. Open the .ppk file in PuTTYgen and go to the Conversions menu. Choose Export OpenSSH key and save the new file. This exported key works everywhere that OpenSSH is accepted.

When you use PuTTY itself to connect to a server, navigate to Connection > SSH > Auth and browse to your .ppk file. PuTTY will use it automatically. For persistent key management, consider running Pageant, PuTTY’s SSH agent. Pageant holds your decrypted private keys in memory so you never type the passphrase again during a session.

How to Generate SSH Key FAQs

Q1. Can I use the same SSH key across all my servers and services?
Yes, but it is safer to generate a unique keypair for each service or machine in case one key gets compromised. At a minimum, use different keys for personal and work accounts.

Q2. Is it okay to leave the passphrase empty when generating an SSH key?
You can, but it is risky. Without a passphrase, anyone who steals your private key file can access your servers immediately. A strong passphrase encrypts the key, blocking unauthorized use even if the file leaks.

Q3. How do I copy my public key to a remote server without manually opening and editing files?
On most Linux systems, the quickest way is ssh-copy-id user@host. If that command is not available—for example on macOS without the Homebrew package—use this universal command: cat ~/.ssh/id_ed25519.pub | ssh user@host "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys". Adjust the key filename for RSA keys.

Conclusion

You now know three straightforward ways to create an SSH key on any common operating system. Whether you choose the terminal on Linux or macOS, the built‑in OpenSSH on Windows, or the friendly PuTTYgen utility, the result is the same: a much more secure way to access your servers. Take a few minutes, generate a key, and start enjoying password‑free logins today.