# SSH Key generation

**Generate a key pair** with `ssh-keygen`. Modern standard is Ed25519 (fast, secure, small keys). Older RSA keys are also supported but larger.

```bash
$ ssh-keygen -t ed25519 -C "user@host"
$ ssh-keygen -t rsa -b 4096 -C "user@host"     # older standard
```

This creates `~/.ssh/id_ed25519` (private key) and `~/.ssh/id_ed25519.pub` (public key). Protect the private key with a passphrase. The passphrase encrypts the private key file—if someone steals it, they can't use it without the passphrase.

```bash
Generating public/private ed25519 key pair.
Enter file in which to save the key (/home/user/.ssh/id_ed25519): 
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
```

The public key is safe to share. Copy it to servers and add to `~/.ssh/authorized_keys`:

```bash
$ ssh-copy-id -i ~/.ssh/id_ed25519.pub user@host
```

Or manually:

```bash
$ cat ~/.ssh/id_ed25519.pub | ssh user@host "cat >> ~/.ssh/authorized_keys"
```

File permissions matter:

```bash
$ chmod 700 ~/.ssh              # directory
$ chmod 600 ~/.ssh/id_ed25519   # private key
$ chmod 644 ~/.ssh/id_ed25519.pub  # public key
$ chmod 644 ~/.ssh/authorized_keys  # on server
```

View key fingerprint: `ssh-keygen -lf ~/.ssh/id_ed25519.pub`. Never share your private key.