TopolearnKey-based login is more secure and more convenient than passwords, and it is required by Git hosts and most clouds.
Public-key authentication uses a key pair: a private key that never leaves your machine, and a public key you can give to any server. The server checks that you can sign a challenge with the private key matching a public key it trusts.
Create one with ssh-keygen:
ssh-keygen -t ed25519 -C "alice@laptop"makes~/.ssh/id_ed25519(private) and~/.ssh/id_ed25519.pub(public). The-Ccomment helps you recognise the key later.- Ed25519 is the modern default: small, fast and secure. Use
-t rsa -b 4096only for old systems that do not support it. - Set a passphrase when asked. It encrypts the private key on disk, so a stolen laptop or backup does not leak access. The ssh-agent lesson removes the cost of typing it.
The public key is one line like ssh-ed25519 AAAAC3Nz... alice@laptop; it is safe to paste into GitHub, a cloud console or a colleague's server.
The private key file must be readable only by you (chmod 600); ssh refuses to use a key with loose permissions. Hardware-backed keys (-t ed25519-sk) keep the secret on a FIDO2 security key such as a YubiKey and require a touch to use.
One key per device (not one shared key copied everywhere) makes revoking a lost laptop easy.
Example
ssh-keygen -t ed25519 -C "alice@laptop"
# Enter file in which to save the key (~/.ssh/id_ed25519): <Enter>
# Enter passphrase: ********
ls -l ~/.ssh
# -rw------- 1 alice alice 464 id_ed25519 <- private, keep secret
# -rw-r--r-- 1 alice alice 101 id_ed25519.pub <- public, share freely
cat ~/.ssh/id_ed25519.pub
# ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAI... alice@laptop
ssh-keygen -lf ~/.ssh/id_ed25519.pub # show its fingerprintRemember
- Private key stays on your machine; the .pub file is safe to share
- Prefer ed25519; protect the private key with a passphrase
- One key per device makes revocation simple
Watch out for
- Pasting the private key (no .pub) into a website or chat; if that happens, generate a new key.