SSH Keys and Key Pairs Explained: Which Type to Pick

A key pair is two linked keys. What one locks, only the other can open. Developers use them to sign in to servers over SSH, to sign code and to set up encrypted connections.

Public and private

• The public key can be shared with anyone. You put it on a server or a service like GitHub.
• The private key stays with you and is never shared. It proves who you are.
• When you connect, the server sends a challenge that only the matching private key can answer. Your private key never leaves your computer.

Which type to choose

• Ed25519: small, fast and modern. The best choice for new SSH keys if the server supports it, and nearly all do now.
• RSA: older and supported everywhere. Use 3072 bits or more for new keys, and 2048 only if you must.
• ECDSA P-256: small keys, widely supported, though it's harder to implement safely than Ed25519.

The Key Pair Generator makes all of these in your browser. For Ed25519 it saves the private key in OpenSSH's own file format, and for the others in PKCS#8. We tested each file type with OpenSSH to make sure it's accepted.

Using the keys

1. Save the private key as id_ed25519 (or the name for your type) in the hidden .ssh folder in your home folder.
2. On Mac and Linux, run chmod 600 on it so only you can read it. SSH refuses keys that other users can read.
3. Add the public key line to the server's authorized_keys file, or paste it into the service's settings page.
4. Connect with ssh as usual. No password is needed.

What the odd text is

Keys are binary data written as text, so they look like long strings of letters. Both the PEM format and the SSH public key line use Base64. You can see how that encoding works with the Base64 Encoder. The fingerprint shown is a SHA-256 hash of the public key, a short way to check that two people are looking at the same key. See the Hash Generator for more on hashes.

Be careful with private keys

Anyone with your private key can act as you. Don't email it, paste it into chats or commit it to a code repository. For keys that protect something valuable, make them on your own computer with ssh-keygen and add a passphrase.