SSH key authentication: log in without a password

With SSH key authentication you log in with a key file instead of a password. Your private key stays on your computer, and the matching public key is added to the server. Keys cannot be guessed the way passwords can, so they stop brute-force login attempts. If you do not have a key yet, create one first with Generate SSH keys.

How key login works

1. You add your public key (the .pub file) to ~/.ssh/authorized_keys on the server.
2. When you connect, the server asks your computer to prove it holds the matching private key.
3. Your SSH client signs the request with the private key. The private key never leaves your computer.

Where you can use SSH keys

Install your public key

The easy way, with ssh-copy-id (macOS and Linux). It logs in with your password once and adds the key for you:

ssh-copy-id -i ~/.ssh/id_ed25519.pub root@your-server-ip

# custom SSH port
ssh-copy-id -i ~/.ssh/id_ed25519.pub -p 2222 root@your-server-ip

By hand, if ssh-copy-id is not available. Log in with your password, then run:

mkdir -p ~/.ssh && chmod 700 ~/.ssh
echo "ssh-ed25519 AAAA...your-public-key... you@laptop" >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys

Paste the whole public key on one line: it starts with ssh-ed25519 or ssh-rsa and ends with a comment such as your email address.

From Windows

Windows 10 and 11 include OpenSSH. In PowerShell, ssh-copy-id is not available, so pipe the key instead:

type $env:USERPROFILE\.ssh\id_ed25519.pub | ssh root@your-server-ip "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"

If you use PuTTY, load your private key (.ppk) under Connection → SSH → Auth → Credentials. PuTTYgen converts between PuTTY and OpenSSH key formats.

Test the key login

Keep your current session open and test from a new terminal window:

ssh -i ~/.ssh/id_ed25519 root@your-server-ip

# shows which keys are tried and why one is rejected
ssh -v -i ~/.ssh/id_ed25519 root@your-server-ip

If you are asked for the key's passphrase (not the server password), the key login works.

Stop retyping the passphrase

Load the key into ssh-agent once per session:

# macOS and Linux
eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519

# Windows PowerShell (as administrator, once)
Get-Service ssh-agent | Set-Service -StartupType Automatic
Start-Service ssh-agent
ssh-add $env:USERPROFILE\.ssh\id_ed25519

Add a host entry to ~/.ssh/config so ssh myserver picks the right user, port and key. See Generate SSH keys for an example.

Turn off password logins

Only after the key login works, on a VPS or dedicated server you can stop password logins completely:

PasswordAuthentication no
KbdInteractiveAuthentication no
PubkeyAuthentication yes

# check the configuration, then reload SSH
sshd -t && systemctl reload sshd    # AlmaLinux, Rocky Linux, CloudLinux
sshd -t && systemctl reload ssh     # Debian, Ubuntu

Troubleshooting

"Permission denied (publickey)": the server did not accept any key. Check that the public key is on one line in authorized_keys, that you log in as the user whose file holds the key, and that you pass the right private key with -i.

Still asked for the server password: SSH ignores authorized_keys when permissions are too open. Run chmod 700 ~/.ssh and chmod 600 ~/.ssh/authorized_keys, and make sure the files belong to that user.

"UNPROTECTED PRIVATE KEY FILE": your private key is readable by others on your computer. Run chmod 600 ~/.ssh/id_ed25519.

Too many authentication failures: your agent offers many keys and the server stops after a few. Add IdentitiesOnly yes and the right IdentityFile to the host in ~/.ssh/config.

FAQ

Related: Generate SSH keys | Manage SSH keys on your VPS | SSH hardening | SSH access basics

Related articles