Key Generation

~15 min · ssh-keygen, ed25519, passphrase, rsa

Level 0Pinger

0 XP0/101 lessons0/12 achievements

0/150 XP to next level150 XP to go0% complete

Generating your pair

ssh-keygen creates the pair. Use ed25519 — it's modern, fast, short, and as secure as oversized RSA. The -C comment is critical: it's the line you'll see in authorized_keys when auditing access months from now, so make it identify the device clearly.

Why ed25519 over RSA

Property	ed25519	RSA
Key size	256 bits	3072–4096 bits
Security level	~128 bits	~128 bits at 3072
Sign/verify speed	Very fast	Slower, especially at 4096
Public key length	~80 chars	~700 chars
Algorithm	EdDSA on Curve25519	RSA factoring

There's no reason to generate new RSA keys today. The exception: an ancient server pinned to legacy algorithms. For everything else, ed25519.

Naming the file

By default, ssh-keygen -t ed25519 writes to ~/.ssh/id_ed25519. If you want a separate key for a specific use (work GitHub, a particular cloud provider), name it explicitly with -f — then point at it from ~/.ssh/config per host.

Code

Generate the pair·bash

# Standard generation — set a passphrase when prompted
ssh-keygen -t ed25519 -C "you_username@macbook-2026"

# Named key for GitHub specifically
ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519_github -C "github-personal"

# Look at what got created
ls -la ~/.ssh/id_ed25519*

# Show the fingerprint of a key
ssh-keygen -lf ~/.ssh/id_ed25519.pub

External links

Exercise

If you don't have an ed25519 key on this Mac, generate one now: ssh-keygen -t ed25519 -C "$(whoami)@$(hostname -s)-$(date +%Y)". Set a passphrase (anything memorable). Verify with ls -la ~/.ssh/id_ed25519* that you have both the private (mode 600) and public (mode 644) files. Run ssh-keygen -lf ~/.ssh/id_ed25519.pub to see the fingerprint — that's what servers identify your key by.