ssh-keygen
Networking
Usage
ssh-keygen -t ed25519 -C "<comment>"Creates a public and private key pair; only the `.pub` half ever goes on a server, and a key made without a passphrase is a plain file that anyone who copies it can log in with.
Common flags
| Flag | Meaning |
|---|---|
| -t ed25519 | Key type. ed25519 is the modern default; rsa needs -b 4096 to be worth using. |
| -C "you@laptop" | A comment so you can tell your keys apart later. |
| -f <path> | Where to write the key, when you want more than one. |
| -N "" | No passphrase. Then the file alone is enough to log in. |
| -p | Change or add the passphrase on an existing key. |
| -l -f <key.pub> | Print the fingerprint, to compare against what a server shows. |
| -y -f <key> | Recreate the public half from a private key. |
| -R <host> | Remove a host from known_hosts after it was rebuilt. |
Examples
ssh-keygen -t ed25519 -C "jade@laptop"Create a modern key pair in ~/.ssh.
ssh-keygen -R old.example.comFix the "REMOTE HOST IDENTIFICATION HAS CHANGED" warning properly.
ssh-keygen -lf ~/.ssh/id_ed25519.pubThe fingerprint of your public key.
When a connection fails, these narrow down how far it got — name not resolving, no route, or a blocked port.
How to read this
- Square brackets [ ] mark a part you may leave out.
- An ellipsis … means you can list more than one.
- Flags are case-sensitive — in some commands -r and -R do different things.
Questions
Q. What does ssh-keygen do?
Creates a public and private key pair; only the `.pub` half ever goes on a server, and a key made without a passphrase is a plain file that anyone who copies it can log in with.
Q. How do I type it?
ssh-keygen -t ed25519 -C "<comment>" — square brackets mark the parts you can leave out.
Q. How many flags are worth knowing?
8 are listed here; the full set is in man ssh-keygen. This command sits under Networking.
Related commands
man page: man ssh-keygen