🔑

SSH keys: never type a password again

Passwords are so last decade.

Passwords can be guessed. A proper SSH key can't be, not in a million years. Set it up once and you'll log in to your servers with a single short command and no password.

Beginner30 minutesSSH

🧰 What you need

Your computer (Windows, macOS or Linux) and a Linux server you can SSH to

Let's build it

Make your key pair

ssh-keygen -t ed25519 -C "my laptop"

Press Enter to accept the location, and set a passphrase (your key's own password). You now have two files: id_ed25519 (private: never share it) and id_ed25519.pub (public: share it freely).

Give the server your public key

ssh-copy-id your-username@your-server-ip

On Windows, where ssh-copy-id doesn't exist, run this in PowerShell instead:
type $env:USERPROFILE\.ssh\id_ed25519.pub | ssh your-username@your-server-ip "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"

Log in with the key

ssh your-username@your-server-ip

It asks for your key's passphrase (or nothing at all, if you left it empty), not the server's password.

Give it a nickname

Add this to ~/.ssh/config on your computer:

Host lab
    HostName your-server-ip
    User your-username

Now ssh lab is all you ever type.

Close the password door (optional, pro move)

Only once key login definitely works, on the server:

echo 'PasswordAuthentication no' | sudo tee /etc/ssh/sshd_config.d/10-no-passwords.conf
sudo systemctl restart ssh

✅ How you know it worked

ssh lab logs you straight in, and ssh -o PubkeyAuthentication=no lab is refused if you closed the password door.

💥 Break it on purpose

On the server, rename your key away:

mv ~/.ssh/authorized_keys ~/.ssh/authorized_keys.bak

Open a new terminal and try ssh lab. If you disabled passwords, you're now locked out, so do this with a second session still open. Put it back with mv ~/.ssh/authorized_keys.bak ~/.ssh/authorized_keys.

🧠 What's really going on

Your private key never leaves your computer. When you connect, the server uses your public key to set a challenge that only the matching private key can answer. Nothing secret crosses the network, so there's nothing to steal or guess, and an ed25519 key is far stronger than any password a human could remember.

← Back to all Linux labs · Stuck? Email me