___________ __________ _____ ________ ________ .____ ___________ \_ _____/ \______ \ / _ \ / _____/ / _____/ | | \_ _____/ | __) | _/ / /_\ \ / \ ___ / \ ___ | | | __)_ | \ | | \ / | \ \ \_\ \ \ \_\ \ | |___ | \ \___ / |____|_ / \____|__ / \______ / \______ / |_______ \ /_______ / \/ \/ \/ \/ \/ \/ \/

ssh-keygen Cheatsheet

← Back to cheatsheets

← Home

ssh-keygen generates, manages, and converts SSH authentication keys. Essential for passwordless SSH access and secure key-based authentication.

Key Generation

  • ssh-keygen -t ed25519 - Generate Ed25519 key (recommended)
  • ssh-keygen -t rsa -b 4096 - Generate RSA key (4096 bits)
  • ssh-keygen -t ecdsa -b 256 - Generate ECDSA key
  • ssh-keygen -f ~/.ssh/id_ed25519 - Specify key file location
  • ssh-keygen -C "comment" - Add comment to key

Key Management

  • ssh-keygen -l -f ~/.ssh/id_ed25519.pub - Show key fingerprint
  • ssh-keygen -y -f ~/.ssh/id_ed25519 - Extract public key from private key
  • ssh-keygen -p -f ~/.ssh/id_ed25519 - Change passphrase
  • ssh-keygen -R hostname - Remove host from known_hosts

Key Conversion

  • ssh-keygen -p -m PEM -f old_key - Convert key format
  • ssh-keygen -e -f id_rsa.pub -m RFC4716 - Convert to RFC4716 format
  • ssh-keygen -i -f publickey - Import key in other formats

Common Examples

Generate Ed25519 Key

ssh-keygen -t ed25519 -C "your_email@example.com"

Generate modern Ed25519 key with email comment.

Generate RSA Key

ssh-keygen -t rsa -b 4096 -f ~/.ssh/id_rsa

Generate 4096-bit RSA key.

Show Fingerprint

ssh-keygen -l -f ~/.ssh/id_ed25519.pub

Display key fingerprint for verification.

Change Passphrase

ssh-keygen -p -f ~/.ssh/id_ed25519

Change passphrase on existing key.

Copy Public Key

cat ~/.ssh/id_ed25519.pub

Display public key to copy to server.

Remove Host Key

ssh-keygen -R example.com

Remove host from known_hosts (after key change).

Tips

  • Ed25519 is preferred: smaller, faster, and more secure than RSA
  • Use RSA 4096-bit minimum if Ed25519 isn't supported
  • Always use passphrases for private keys
  • Keep private keys secure (~/.ssh/id_*), never share them
  • Public keys (.pub) are safe to share
  • Use ssh-copy-id to easily copy keys to servers
  • Verify fingerprints out-of-band before trusting new hosts