What Is SSH Key Authentication?

Category: FTP & File Management · Updated 2026-10-31

SSH key authentication proves your identity to a server using a mathematically linked pair of keys instead of a password: a private key that never leaves your computer, and a public key placed on the server. The server challenges your computer to prove it holds the matching private key, and the private key itself is never transmitted, which makes this method far more resistant to guessing and brute-force attacks than a password.

How a key pair works

An SSH key pair consists of two mathematically related files: a private key, kept secret on your own computer, and a public key, which is safe to share and gets placed on the server in a file called authorized_keys. When you connect, the server sends a challenge that only the matching private key can answer correctly, which proves you hold it without ever sending the private key itself over the network.

SSH keys vs. passwords

	Password	SSH key
Resistance to brute force	Limited by password strength	Effectively impractical to guess
What's transmitted	The secret itself (even if encrypted in transit)	Only a signed challenge, never the private key
Convenience	Type it every time, or save it insecurely	Set up once, then connect automatically
Risk if leaked	Usable immediately by anyone who has it	Useless without the matching private key and its passphrase

Generating and installing a key pair

Most systems generate and copy a key pair with two commands:

# Generate a new key pair (follow the prompts to set a passphrase)
ssh-keygen -t ed25519 -C "your_email@example.com"

# Copy the public key to a server
ssh-copy-id user@your-server-ip

This creates a private key file (commonly id_ed25519) and a matching public key file (id_ed25519.pub) in your ~/.ssh folder, then appends the public key to the server's ~/.ssh/authorized_keys file for that user.

Protecting the private key

Set a passphrase when generating the key so the file alone is useless if it is ever copied off your computer.
Keep file permissions restrictive; most SSH clients refuse to use a private key that other users on the system can read.
Use ssh-agent to unlock the key once per session instead of typing the passphrase on every connection.
Never send a private key file by email or chat; only the public key is meant to be shared.

Turning off password login once keys are set up

Once a key pair is confirmed working, many administrators disable password-based SSH login entirely so a stolen or guessed password can no longer be used to get in, by editing the server's SSH daemon configuration:

# In /etc/ssh/sshd_config
PasswordAuthentication no

# Then restart the SSH service
sudo systemctl restart sshd

Always confirm key-based login works in a separate session before disabling password login, since a mistake in the configuration can lock out access to the server entirely.

Frequently asked questions

Is SSH key authentication more secure than a password?

Yes. A private key is effectively impossible to guess through brute force, and it is never transmitted over the network during login, unlike a password which can be guessed, phished or intercepted if the connection is misconfigured.

Can I use the same SSH key pair on multiple servers?

Yes, the same public key can be added to the authorized_keys file on as many servers as you like, all unlocked by the one private key you keep on your own computer.

What happens if I lose my private key?

You lose the ability to log in with it. You would need another access method, such as a password, a hosting provider's console, or another already-authorized key, to add a newly generated key pair in its place.

Do I still need a password if I use an SSH key?

No, once a key is set up and working you can disable password login entirely for that account, which is a common security hardening step on a VPS or dedicated server.

What is a passphrase on an SSH key for?

A passphrase encrypts the private key file itself, so if the file is ever stolen or copied, it still cannot be used without also knowing the passphrase.

Which key type should I generate, RSA or Ed25519?

Ed25519 is the current recommendation for most uses, since it is faster and uses shorter keys than RSA while providing comparable or stronger security; RSA remains widely supported for older systems that do not yet support Ed25519.