Creating an SSH key on Windows, Mac and Linux

An SSH key is safer and easier than a password. It consists of two parts:

• the private key, which stays on your own computer and which you share with no one, not even with us;
• the public key, the file ending in .pub. You put this on your server.

Creating the key

The command is the same on Windows, Mac and Linux. Open a terminal (on Windows, PowerShell or Terminal) and type:

ssh-keygen -t ed25519 -C "anna laptop"

1. Press Enter when asked where to save the key. It will then be saved in the default location.
2. Choose a passphrase: a phrase that protects your key if someone gets hold of your laptop. Type it twice.

With -C you give the key a recognisable name. That way you can later see on the server which key belongs to which device. Create a separate key for each device; if you lose your laptop, you only need to remove that key.

Where is your key?

To display your public key, use:

cat ~/.ssh/id_ed25519.pub
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK0vU3kQ1yQh7j3mEXAMPLEcDqzX1o2p3R4tY5uV6wZ anna laptop

On Windows, cat also works in PowerShell, with cat $env:USERPROFILE\.ssh\id_ed25519.pub. Copy that single line. Paste it into the VPS screen during installation (see Installing your VPS: operating system, password and SSH key) or add it to a running server (see Putting your key on the server and testing it).

No need to keep typing your passphrase

With the ssh-agent, you type your passphrase once per session.

• Mac: the agent is already running. Add your key with ssh-add --apple-use-keychain ~/.ssh/id_ed25519; your keychain will then remember the passphrase.
• Linux: on most desktops the agent is already running. Add your key with ssh-add.
• Windows: the ssh-agent service is disabled by default. Enable it once in PowerShell as administrator:

Get-Service ssh-agent | Set-Service -StartupType Automatic
Start-Service ssh-agent
ssh-add $env:USERPROFILE\.ssh\id_ed25519

Please note: Your private key is just as secret as a password. Never send it by email or chat, don't put it in a shared folder and never paste it into a form. Only the file ending in .pub belongs on the server.