`ssh-keygen` Create an SSH key pair on your Mac

Generates a private key and a matching public key. The private key stays on your Mac in ~/.ssh and proves who you are. The public key (the file ending in .pub) is safe to copy to any router, NAS or GitHub account you want to log in to without a password.

Synopsis

ssh-keygen [-t TYPE] [-C COMMENT] [-f FILE]

Common options

Option or form	What it does
`-t TYPE`	Key type. Use ed25519: it is short, fast and secure. Use rsa with -b 4096 only for old devices that reject ed25519
`-C COMMENT`	A label stored in the public key, usually your email or a device name, so you can tell keys apart later
`-f FILE`	Where to save the private key. The public key is saved beside it with .pub added. Defaults to ~/.ssh/id_ed25519
`-b BITS`	Key length in bits. Only matters for RSA, where 4096 is a good choice
`-p`	Change the passphrase on an existing private key
`-l -f FILE`	Show the fingerprint of a key, to check it matches what GitHub or a device shows
`-y -f FILE`	Print the public key for an existing private key, if you lost the .pub file

Examples

Create your main key

ssh-keygen -t ed25519 -C "bob@google.com"

Generating public/private ed25519 key pair.
Enter file in which to save the key (/Users/you/.ssh/id_ed25519):
Enter passphrase (empty for no passphrase):
Your identification has been saved in /Users/you/.ssh/id_ed25519
Your public key has been saved in /Users/you/.ssh/id_ed25519.pub

Create a separate key just for GitHub

ssh-keygen -t ed25519 -C "github" -f ~/.ssh/id_ed25519_github

Create an RSA key for an old router or NAS

ssh-keygen -t rsa -b 4096 -C "nas" -f ~/.ssh/id_rsa_nas

Copy the public key to the clipboard

pbcopy < ~/.ssh/id_ed25519.pub

Check a key's fingerprint

ssh-keygen -l -f ~/.ssh/id_ed25519.pub

Add or change the passphrase later

ssh-keygen -p -f ~/.ssh/id_ed25519

Notes

Set a passphrase when asked. It encrypts the private key on disk, and the Keychain (see ssh-add) remembers it for you, so it costs nothing day to day.
Never share, email or paste the private key (the file without .pub). Only the .pub file goes anywhere else.
If ~/.ssh does not exist, ssh-keygen creates it with the right permissions. If you make it by hand, run chmod 700 ~/.ssh.
Do not overwrite an existing key unless you mean to: ssh-keygen asks first, and answering y locks you out of every server that trusts the old one.
One key per person per Mac is fine. Use separate keys only when you want to revoke access to one service without touching the others.

ssh-keygen Create an SSH key pair on your Mac

Synopsis

Common options

Examples

Notes

See also

`ssh-keygen` Create an SSH key pair on your Mac