How to Generate and Use SSH Keys (Mac, Windows, Linux)
%203.png&w=256&q=75){kind=small}
Choosing the Right Key Type
Use Ed25519 for all new SSH keys. It produces shorter keys than RSA (256-bit vs 2048–4096 bit), connects faster, and is considered more secure against side-channel attacks. RSA 4096 is still fine if you need compatibility with very old servers or hardware tokens that don't support Edwards curves.
Avoid DSA (deprecated and broken), ECDSA (fine but Edwards curve Ed25519 is superior), and RSA below 2048 bits. If you have old RSA 1024-bit keys in production, rotate them immediately — they are considered crackable.
Generate Keys on Mac and Linux
Both macOS and Linux include OpenSSH by default. Open Terminal and run:
The -C flag sets a comment label — use it to identify which machine the key belongs to, not your email. When you have 10 authorized_keys entries, "work-laptop-2026" is far more useful for auditing than "user@machine".
Generate Keys on Windows
Windows 10 and 11 include OpenSSH. Open PowerShell (no admin required) and use the same ssh-keygen command:
~/.ssh/ in Linux home). Keys stored in Windows (/mnt/c/Users/...) will have incorrect permissions and SSH will refuse to use them.Add Your Key to the Server
Copy your public key to the server's ~/.ssh/authorized_keys file. The key must be on a single line with no line breaks:
Managing Multiple Keys
If you manage multiple servers or have separate keys for work and personal use, the SSH agent saves you from specifying the key file on every connection. Add keys to the agent at login:
CloudStick SSH Vault
CloudStick's SSH Vault stores public key references centrally in your account. When you add a new server, you choose which stored keys get added to authorized_keys during provisioning — no manual ssh-copy-id required.
The SSH Keys section in each server's panel shows which users have which keys authorized. Revoke access by removing a key from a user — the change takes effect immediately without touching the server directly. For agencies managing team access across dozens of servers, this centralized approach eliminates the manual key-sync problem that causes most accidental lockouts.
