What Is an SSH Key? Secure Server Login Explained

By Editorial Team · Updated August 7, 2026 · 818 words · AdSense-ready length

An SSH key is a cryptographic key pair used to authenticate Secure Shell (SSH) connections — the standard way developers and administrators log into remote servers, push code to Git, and transfer files without typing a password each time. The pair consists of a private key (kept secret on your computer) and a public key (installed on servers you want to access). Prove you hold the private key, and the server grants access.

What It Is

SSH replaces telnet-era plaintext remote login with encrypted sessions. Password login works but suffers brute-force attacks and phishing on exposed port 22.

Key-based authentication uses asymmetric cryptography:

Private key — never share; often protected by passphrase; lives in ~/.ssh/id_ed25519 or similar
Public key — safe to distribute; appended to server's ~/.ssh/authorized_keys file

Common key types today:

| Algorithm | Notes |

|-----------|-------|

| Ed25519 | Modern default — fast, secure, compact |

| RSA 4096 | Legacy compatibility — larger keys |

| ECDSA | Supported; some prefer Ed25519 instead |

When you run ssh user@server.example.com, the server sends a challenge; your SSH client signs it with your private key; the server verifies with your public key — no password crosses the network for auth itself.

Why It Matters

Security — keys resist online guessing attacks better than short passwords. Combined with disabling password auth on servers, SSH keys dramatically shrink attack surface.

Automation — CI/CD pipelines (GitHub Actions, GitLab CI) deploy using SSH keys without human prompts — essential for modern DevOps.

Developer workflow — git push over SSH to GitHub/GitLab uses the same mechanism — your public key registered in account settings.

Compliance — many security baselines require key-based access, jump hosts, and no shared root passwords.

M mishandling private keys — committing them to Git, leaving unencrypted on laptops — causes major breaches. Keys are powerful; treat private keys like passwords.

How It Works

Setup overview:

1. Generate pair: ssh-keygen -t ed25519 -C "you@email.com"

2. Optionally set passphrase encrypting private key at rest

3. Copy public key to server: ssh-copy-id user@host or manual paste

4. Connect: ssh user@host — client offers key; server checks authorized_keys match

Agent forwarding and ssh-agent

ssh-agent holds decrypted keys in memory so you type passphrase once per session. Agent forwarding chains through bastion hosts — powerful but risky if intermediate servers are untrusted.

Git hosting

Add public key to GitHub → Settings → SSH keys. Clone via git@github.com:user/repo.git instead of HTTPS URL.

Revocation

Remove public key line from authorized_keys on server — instant access revocation without changing passwords for other users.

Common Examples

| Use case | SSH key role |

|----------|--------------|

| Cloud VPS (AWS EC2, DigitalOcean) | Inject public key at instance creation |

| Git push/pull | Authenticate to github.com |

| rsync/scp backups | Automated nightly sync scripts |

| Ansible/Terraform provisioning | Admin access without interactive login |

| SFTP file exchange | Same keys as SSH shell access |

Deploy keys are repo-scoped keys for read-only CI access — narrower blast radius than personal account keys.

Common Misconceptions

"SSH key and SSL certificate are the same"

Both use public-key crypto but serve different protocols. SSH secures shell/sftp. TLS/SSL secures HTTPS. Do not swap them.

"Public key must stay secret"

Only private key is confidential. Public key is literally designed to upload to servers — leaking it is normal; leaking private key is catastrophic.

"Passwordless means no passphrase"

Passwordless login to server means no server password — you should still passphrase-protect private key on laptops that might get stolen.

"One key for everything is fine"

Security best practice: separate keys per purpose (personal Git vs. production deploy), rotate periodically, use hardware security modules for high-value access.

"Changing my laptop password rotates SSH keys"

Unrelated unless private key file encrypted with passphrase tied to OS keychain — rotating keys means generate new pair and update authorized_keys everywhere.

"SSH keys expire automatically"

Keys remain valid until removed from authorized_keys on the server. Set calendar reminders to rotate deploy keys and offboard employees by deleting their public key lines — there is no built-in expiry date like a password reset policy.

Where SSH Keys Live on Your Computer

Private keys typically sit in ~/.ssh/ with restrictive file permissions. Never copy private keys to cloud drives or email them. Public keys use the .pub extension and are safe to paste into GitHub, GitLab, or server authorized_keys files.

The Takeaway

An SSH key is a public-private cryptographic pair enabling secure, passwordless authentication to servers and Git hosts over SSH. Generate Ed25519 keys, passphrase-protect the private key, install only the public key on remote systems, and never commit private keys to repositories.

*This article is for general informational purposes only and does not constitute professional cybersecurity advice.*