How to create and use SSH keys on your VPS, step by step

Why use SSH keys instead of a password

As soon as your VPS has a public IP, automated login attempts start hitting SSH with common passwords. An SSH key solves the problem at the root: instead of a guessable password, you use a pair of files, a private key that never leaves your computer and a public key you copy to the server.

Besides being safer, it's more convenient: you connect without typing the server password every time. If you're still deciding between a shared plan and your own server, read shared hosting or VPS first.

Step 1: generate your key pair

Windows 10 and 11, macOS and every Linux distribution ship the OpenSSH client, so the command is the same on all three. Use the ed25519 type: it's modern, fast and produces short keys.

1. Open a terminal. On Windows use PowerShell; on macOS, the Terminal app; on Linux, whichever you like.
2. Run the command below. The text after -C is just a label to recognize the key.
3. Press Enter to accept the default location (~/.ssh/id_ed25519, or C:\Users\your-user\.ssh\id_ed25519 on Windows).
4. Type a passphrase and repeat it.

ssh-keygen -t ed25519 -C "office-laptop"

Two files are created: id_ed25519 (private, never share it) and id_ed25519.pub (public, the one that goes on the server).

Step 2: copy the public key to the VPS

For this step you still need to log in with the password or the access details from your welcome email. We'll use the user admin and the IP 203.0.113.10 as an example.

On macOS and Linux: ssh-copy-id

ssh-copy-id -i ~/.ssh/id_ed25519.pub admin@203.0.113.10

The command asks for the server password one last time, creates the ~/.ssh folder if needed and appends your key to authorized_keys with the right permissions.

On Windows or by hand

PowerShell doesn't include ssh-copy-id, but you can do the same in one line:

type $env:USERPROFILE\.ssh\id_ed25519.pub | ssh admin@203.0.113.10 "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"

To do it fully by hand, log in to the server, paste the contents of your .pub file as a single line into ~/.ssh/authorized_keys and fix the permissions. SSH ignores the key if another user can modify the folder or the file:

mkdir -p ~/.ssh
nano ~/.ssh/authorized_keys
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

Test the connection with ssh admin@203.0.113.10. If it asks for your key passphrase (not the server password), it works.

Step 3: create an alias in ~/.ssh/config

Typing the user, IP and key on every connection gets old fast. The ~/.ssh/config file on your computer lets you save everything under a short name:

Host yourbusiness
    HostName 203.0.113.10
    User admin
    IdentityFile ~/.ssh/id_ed25519
    IdentitiesOnly yes

From now on ssh yourbusiness is enough, and the alias also works with scp, rsync and Git. IdentitiesOnly yes stops SSH from trying every key you have and getting you locked out for too many attempts.

Step 4: disable password logins

As long as the server accepts passwords, bots can keep trying. Once you've confirmed your key works, turn them off. On Ubuntu 24.04 and Debian 12 the cleanest way is to create your own file in /etc/ssh/sshd_config.d/ instead of editing the main file:

1. Create the file with sudo nano /etc/ssh/sshd_config.d/00-keys-only.conf. The 00- prefix matters: SSH keeps the first value it reads, and some cloud images ship a 50-cloud-init.conf that turns passwords back on.
2. Paste these lines and save:

PasswordAuthentication no
KbdInteractiveAuthentication no
PubkeyAuthentication yes

3. Check for syntax errors with sudo sshd -t (no output means it's fine).
4. Restart the service with sudo systemctl restart ssh. On Ubuntu and Debian it's called ssh; on AlmaLinux, Rocky or Fedora use sudo systemctl restart sshd.
5. Confirm the effective value with sudo sshd -T | grep -i passwordauthentication. It should say passwordauthentication no.

Common errors and how to fix them

These are the three messages you'll see most often when starting with SSH keys:

To debug a Permission denied, connect with ssh -v yourbusiness and check which keys your machine offers. On the server side, sudo journalctl -u ssh -n 50 usually states the exact cause, such as permissions that are too open on your home folder. These commands fix the most common cases:

chmod 600 ~/.ssh/id_ed25519
icacls $env:USERPROFILE\.ssh\id_ed25519 /inheritance:r /grant:r "$($env:USERNAME):(R)"
ssh-keygen -R 203.0.113.10

The first is for macOS and Linux, the second for PowerShell on Windows, and the third removes the saved fingerprint of a server you reinstalled. With your keys ready, move on to how to secure a Linux VPS or deploy your Node app with Nginx.