An SSH key pair is the safest way to log in to a server, safer than a password. You create a private key and a public key, place the public key on the server, and from then on use the private key to log in without a password, but still encrypted. In this article you’ll learn how to set this up in a few steps, on Windows, macOS and Linux.
What is an SSH key pair
SSH authentication with keys works with two matching files: a private key that stays only on your own computer, and a public key that you place on the server. When logging in, the server checks whether your private key matches the stored public key, without the private key ever being sent over the network. This makes it much harder to break in than with a password, because an attacker would not only have to guess the password but would also need physical access to your private key.
In addition, you can further secure the private key with a passphrase, so that even if someone obtains the file, they can’t do anything with it without knowing that passphrase.
Creating SSH keys
Creating a key pair works almost identically on Windows, macOS and Linux, since they all use OpenSSH.
Open a terminal
On macOS and Linux, open the Terminal app. On Windows 10 or 11, open PowerShell or the built-in Terminal; OpenSSH is already included there by default.
Generate the key pair
Run the command ssh-keygen -t ed25519 -C "[email protected]". If your system doesn’t work with ed25519, use ssh-keygen -t rsa -b 4096 as an alternative.
Choose a storage location
Press Enter to accept the default location (usually ~/.ssh/id_ed25519), or specify your own path if you want to manage multiple keys.
Set a passphrase
Enter a passphrase to further secure the private key. If you leave this field empty, the key will still work, just without that extra layer of security.
After these steps, two files are ready: a private key (without extension) and a public key with the .pub extension. You may share the public key, but never the private key.
Placing the public key on the server
To actually be able to log in with the key, the public key must be known to the server. There are a few ways to do this.
The command ssh-copy-id user@server-ip automatically adds the public key to the authorized_keys file on the server. If this command isn’t available, for example on Windows without extra tools, manually copy the contents of the .pub file and paste it into the ~/.ssh/authorized_keys file on the server.
If you work with a control panel such as Plesk, you can often add public SSH keys directly to the user account via the interface, without having to edit files yourself. If you’re considering switching to another provider, check out the page about switching to Tandata for more information on how that works, including transferring access to your server.
Using and managing the key
Once the public key is on the server, you log in with ssh user@server-ip. If you’ve set a passphrase, the system will ask for it; without a passphrase you log in directly.
If you use multiple keys for different servers or projects, for example for your web hosting and separate VPS environments, you can keep this organized with a configuration file (~/.ssh/config) in which you specify per server which key should be used.
If you want to disable password authentication entirely so that only keys grant access, adjust this in the SSH server configuration. Only do this once you’re certain the key connection works. Questions about this or other server settings can always be found in the knowledge base, or asked via 24/7 support.
Frequently asked questions
Is ed25519 better than RSA?
Ed25519 keys are shorter, faster to process, and supported by most modern systems. RSA is still secure, but is often only used when a system doesn’t support ed25519.
What if I forget my passphrase?
There is no way to recover a forgotten passphrase. You’ll need to create a new key pair and remove the old public key from the server.
Can I use the same key pair on multiple servers?
Yes, you can add the same public key to multiple servers. However, for better overview and security, it’s advisable to use a separate key pair per environment.
Is SSH with keys also relevant if I only host email?
For purely managing email via a business email solution, you usually don’t need SSH access. SSH is mainly relevant if you also perform server or file management via the command line.
Where do I find my SSH settings in Plesk?
In Plesk, the settings for SSH keys are usually found under the user account or hosting settings, where you can add or remove public keys.
Conclusion
Creating an SSH key pair takes a few minutes, but provides much safer and often easier access to your server than logging in with just a password. Generate the key pair, place the public key on the server, and keep the private key safe, optionally with a passphrase. This way, you’ll connect to your environment quickly and securely from now on.