# Setting up SSH keys, properly, on any OS
Source: https://vpsdime.com/knowledgebase/getting-started/setting-up-ssh-keys
Last reviewed: 2026-07-04
Summary: Generate an ed25519 key pair with the same command on Windows, macOS, and Linux, understand which file stays secret, get the key onto your VPS (the saved-keys page and GitHub import at deploy, or ssh-copy-id on a running server), then the agent, the ~/.ssh/config quality-of-life file, multiple devices, and the classic failure modes.

## What this is

The full path from "no key" to "logging in everywhere with keys": generate, deploy, and the quality-of-life pieces most guides skip. Why bother is covered elsewhere in one line, no password to guess, brute force pointless, [no more banned IPs](https://vpsdime.com/knowledgebase/client-area/support/ssh-firewall), this page is the how.

One concept before the commands: a key is a **pair of files**. The **private key** stays on your device, is never uploaded anywhere, and is the thing to protect. The **public key** (the `.pub` file) is what you hand out, to your VPS, to GitHub, to anyone, it's called public because it is.

## Generate the pair (same command everywhere)

Windows 10/11 (PowerShell), macOS (Terminal), and Linux all ship the same OpenSSH tooling now, no PuTTYgen required:

```
ssh-keygen -t ed25519
```

- Accept the default location (`~/.ssh/id_ed25519` and `id_ed25519.pub`; on Windows, `C:\Users\you\.ssh\`).
- **Set a passphrase.** It encrypts the private key on disk, so a stolen laptop doesn't equal stolen server access, and the agent (below) means you type it rarely.
- `ed25519` is the modern default: small, fast, strong. (Only fall back to `-t rsa -b 4096` for ancient systems that don't speak it.)

Print the public half whenever you need to paste it: `cat ~/.ssh/id_ed25519.pub`, one line starting `ssh-ed25519 ...`.

## Get it onto your VPS

- **Before the VPS exists (the best way):** save the public key on the [SSH Keys page](https://vpsdime.com/knowledgebase/client-area/services/ssh-keys), or import it **straight from your GitHub/GitLab account**, then select it on the [deploy](https://vpsdime.com/knowledgebase/client-area/deploy/deploying-a-new-vps) or [reinstall](https://vpsdime.com/knowledgebase/client-area/services/reinstall-os) form. The server is born trusting your key, and with **key-only login mode** there was never a password to attack.
- **On a running server:** from your machine,

```
ssh-copy-id root@YOUR.VPS.IP
```

does everything (appends the key to `~/.ssh/authorized_keys` with correct permissions). Doing it by hand instead: append the `.pub` line to `~/.ssh/authorized_keys` on the server, and make sure permissions are strict, `700` on `~/.ssh`, `600` on the file, SSH refuses keys in sloppy directories. The same strictness extends one level up: a **home directory writable by group or others** also gets the key silently ignored (SSH keeps asking for a password with no error), `chmod 755 ~` fixes it, and `sshd`'s log names the rejected path if you're unsure which level is at fault.

Then test (`ssh root@YOUR.VPS.IP` should log in without a password) and, once it works, [turn off password login](https://vpsdime.com/knowledgebase/getting-started/securing-your-vps).

## The agent: type the passphrase once

The ssh-agent holds your unlocked key for the session, so the passphrase costs you one entry, not one per connection:

```
ssh-add
```

macOS remembers across reboots via the keychain; on Windows, enable the **OpenSSH Authentication Agent** service once (Services app, set to Automatic) and `ssh-add` works the same way.

## The `~/.ssh/config` file: stop typing IPs

The most underrated file in the toolchain, define your servers once:

```
Host web
    HostName 203.0.113.5
    User deploy
    IdentityFile ~/.ssh/id_ed25519
    Port 22
```

From then on, `ssh web`, and every tool that speaks SSH (`scp`, `rsync`, [SFTP clients](https://vpsdime.com/knowledgebase/getting-started/uploading-files-sftp), IDEs) understands the alias too. Changed your [SSH port](https://vpsdime.com/knowledgebase/technical-questions/change-ssh-port)? Update it here once instead of in every command.

## Multiple devices, revocation, and clients

- **One key per device** (laptop, desktop, work machine), not one key copied everywhere. Add each public key to the server; `authorized_keys` happily holds many lines.
- **Revoking a device** is deleting its line from `authorized_keys`. That granularity is the payoff of per-device keys.
- **FileZilla and WinSCP** use the same key for [SFTP](https://vpsdime.com/knowledgebase/getting-started/uploading-files-sftp), point them at the key file. WinSCP and PuTTY historically wanted their own `.ppk` format; both convert OpenSSH keys, though if you're starting fresh, the built-in `ssh` client makes PuTTY optional entirely.
- **New computer, or reinstalling your OS? The key doesn't come along by itself.** Your **private key exists only on your machine**, a fresh computer or a wiped OS has no idea about it, and the server can't help, it only ever saw the public half. Before you retire the old machine, either **copy the key pair across** (both files, `id_ed25519` and `id_ed25519.pub`, into the new machine's `~/.ssh/`, then `chmod 600 ~/.ssh/id_ed25519` on Linux/macOS), or, cleaner, **generate a new pair on the new machine** and add its public key to the server while the old machine still works. The classic mistake is wiping the old computer first and discovering the only key that could log you in went with it, at that point you're recovering via the [Console or SSH-access guide](https://vpsdime.com/knowledgebase/troubleshooting/restore-ssh-access) instead of a two-minute copy.

## When it doesn't work

- **Still asked for a password:** the server didn't accept the key, wrong username (the key went to `root` but you're connecting as `deploy`?), key not in that user's `authorized_keys`, or permissions too loose (check `ls -la ~/.ssh` on the server). `ssh -v web` prints which keys were offered and what the server said, and that verbose output is dense, pasting it whole into an [AI chatbot](https://vpsdime.com/knowledgebase/support-coverage/software-and-server-management) gets it decoded line by line.
- **"WARNING: UNPROTECTED PRIVATE KEY FILE"** on your machine: your private key's permissions are too open, `chmod 600 ~/.ssh/id_ed25519`.
- **Locked out after enabling key-only:** the [Console](https://vpsdime.com/knowledgebase/client-area/services/managing-your-vps) doesn't use SSH, get in there and fix `authorized_keys` or re-enable password auth.

## Still need help?

You can [open a support ticket](https://vpsdime.com/open-ticket/). So we can help on the first reply, it's worth mentioning:

- the VPS hostname or IP,
- your OS, and where it fails (generating, deploying, or logging in),
- the `ssh -v` output for a failing login.

## Related questions

- "How do I generate an SSH key on Windows / Mac / Linux?"
- "What's the difference between the private and public key?"
- "How do I add my SSH key to my VPS?"
- "How do I use the same key with FileZilla or WinSCP?"
- "How do I set up the ssh config file with an alias?"
- "How do I remove a device's access to my server?"