iwantcoding.com
🔥 Daily 👥 Rooms 🏆 Top Log in Sign up

SSH Keys

By · Reviewed & last updated · Part of Git Tutorial

SSH keys for Git are the difference between paste-token-each-time and just-pushing. A modern setup uses ed25519 + a passphrase + an agent.

Git over SSH

EXAMPLE
# 1. Generate a modern key
ssh-keygen -t ed25519 -C 'you@example.com'
# Press enter to save to ~/.ssh/id_ed25519
# Use a strong passphrase - the agent caches it.

# 2. Start the ssh agent
# macOS:    use the built-in via ~/.ssh/config below
# Linux:    eval "$(ssh-agent -s)" ; add to ~/.bashrc
# Windows:  start the OpenSSH Authentication Agent service

ssh-add ~/.ssh/id_ed25519

# 3. ~/.ssh/config (recommended)
Host github.com
  HostName github.com
  User git
  IdentityFile ~/.ssh/id_ed25519
  AddKeysToAgent yes
  IdentitiesOnly yes
  # macOS:
  UseKeychain yes

Host gitlab.com
  HostName gitlab.com
  User git
  IdentityFile ~/.ssh/id_ed25519_gitlab
  IdentitiesOnly yes

# 4. Add the public key to your Git host
cat ~/.ssh/id_ed25519.pub
# Paste into:
#   GitHub:   Settings -> SSH and GPG keys -> New SSH key
#   GitLab:   User Settings -> SSH Keys
#   Bitbucket: Personal settings -> SSH keys

# 5. Test
ssh -T git@github.com
# Hi <username>! You've successfully authenticated...

# 6. Use SSH URLs
git clone git@github.com:owner/repo.git
git remote set-url origin git@github.com:owner/repo.git

# 7. Multiple identities (work + personal)
# Use a different IdentityFile per Host alias; you can also use Host work-github
Host work-github.com
  HostName github.com
  User git
  IdentityFile ~/.ssh/id_ed25519_work
  IdentitiesOnly yes

git clone git@work-github.com:org/repo.git

# 8. Hardware-backed keys (YubiKey, Apple Secure Enclave)
# Generate a key resident on the YubiKey:
ssh-keygen -t ed25519-sk -O resident -C 'you@example.com'
# Use the public key the same way; the private half cannot leave the device.

# 9. Signed commits over SSH (GitHub supports this)
git config --global commit.gpgsign true
git config --global gpg.format ssh
git config --global user.signingkey ~/.ssh/id_ed25519.pub

# 10. Rotate keys yearly; delete unused ones from your Git host

Why it matters

ed25519 + passphrase + agent + ~/.ssh/config is the steady-state setup. Hardware keys (YubiKey, Secure Enclave) take it one step further - keys you cannot lose to malware are the strongest defence against credential theft.

Tip: Tweak the snippet with Try it Yourself », then sit the quiz at the bottom of the page.

Example

Example
ssh-keygen -t ed25519 -C 'you@example.com'
# add ~/.ssh/id_ed25519.pub to GitHub / GitLab SSH keys
Try it Yourself »

Discussion

Loading…