---
title: "How to Create & Add SSH Keys (Ed25519) to a Server"
description: "Generate an Ed25519 SSH key on Linux, macOS or Windows, add it to your client area and to running servers, and simplify your logins with ~/.ssh/config."
url: "https://powerdedi.com/docs/ssh-keys"
last_updated: "2026-09-25"
publisher: "PowerDedi (https://powerdedi.com)"
---

# Create and use SSH keys

Generate an Ed25519 key on any OS, register it in the client area, install it on servers and shorten your logins.

Updated September 25, 2026 · 3 min read · 8 sections

### All guides

Filter the guides

### Getting started

- [Get started with your dedicated server](https://powerdedi.com/docs/getting-started)

### Server management

- [Use the IPMI/KVM console](https://powerdedi.com/docs/ipmi-kvm-console)
- [Reinstall the operating system](https://powerdedi.com/docs/reinstall-os)
- [Repair your server with rescue mode](https://powerdedi.com/docs/rescue-mode)
- [Monitor and repair software RAID](https://powerdedi.com/docs/software-raid)

### Networking

- [Configure IPv6 on your server](https://powerdedi.com/docs/ipv6-configuration)
- [Test your server’s network speed](https://powerdedi.com/docs/network-speed-test)
- [Set up reverse DNS (PTR records)](https://powerdedi.com/docs/reverse-dns)

### Billing

- [Pay with cryptocurrency](https://powerdedi.com/docs/pay-with-crypto)

### Security

- [Secure your server in the first hour](https://powerdedi.com/docs/secure-your-server)
- [Create and use SSH keys](https://powerdedi.com/docs/ssh-keys)

SSH keys let you log in without a password and are far harder to attack than one. You’ll create an Ed25519 key pair on your computer, register the public key with PowerDedi and install it on servers that are already running. All you need is a terminal: Terminal on Linux and macOS, or PowerShell on Windows 10 and 11.

## How SSH keys work

A key pair has two halves. The **private key** stays on your computer, protected by a passphrase, and is never shared. The **public key** is a single line of text that you can copy anywhere: into the client area or into a server’s `~/.ssh/authorized_keys` file. Ed25519 keys are short, fast and supported by every operating system we install.

If an older service accepts only RSA, create an RSA key with `ssh-keygen -t rsa -b 4096`. With a FIDO2 hardware security key, `ssh-keygen -t ed25519-sk` keeps the private key on the device.

## Generate a key on Linux or macOS

```bash
ssh-keygen -t ed25519 -C "alice-laptop"
```

Accept the default location, `~/.ssh/id_ed25519`, and choose a passphrase. The comment after `-C` only helps you recognize the key later. Then display the public key, which you’ll paste in the next steps:

```bash
cat ~/.ssh/id_ed25519.pub
```

To avoid typing the passphrase for every connection, load the key into the SSH agent once per session with `ssh-add ~/.ssh/id_ed25519`. On macOS, `ssh-add --apple-use-keychain ~/.ssh/id_ed25519` also stores the passphrase in your keychain.

## Generate a key on Windows

Windows 10 and 11 include the OpenSSH client. If PowerShell can’t find `ssh-keygen`, add **OpenSSH Client** under **Optional features** in Settings. Then, in PowerShell:

```text
ssh-keygen -t ed25519 -C "alice-laptop"
Get-Content $env:USERPROFILE\.ssh\id_ed25519.pub
```

The key pair is saved in `C:\Users\<you>\.ssh\`. To use the agent, run the first two commands below in an elevated PowerShell window, and the last one as yourself:

```text
Get-Service ssh-agent | Set-Service -StartupType Automatic
Start-Service ssh-agent
ssh-add $env:USERPROFILE\.ssh\id_ed25519
```

## Add the key to the client area

1. Open **Account → SSH keys** and add a new key.
2. Paste the whole public key line, from `ssh-ed25519` to the comment, and give it a name you’ll recognize.
3. Select the key when you order a server, reinstall one or enable rescue mode.

> Keys saved in the client area are installed when a server is set up, reinstalled or booted into rescue mode. They are not pushed to servers that are already running: add them there yourself, as described below.

## Add a key to a running server

From Linux or macOS, `ssh-copy-id` appends the key and sets the right permissions:

```bash
ssh-copy-id -i ~/.ssh/id_ed25519.pub alice@203.0.113.10
```

Windows has no `ssh-copy-id`. This PowerShell line does the same job:

```text
Get-Content $env:USERPROFILE\.ssh\id_ed25519.pub | ssh alice@203.0.113.10 "umask 077; mkdir -p ~/.ssh; cat >> ~/.ssh/authorized_keys"
```

To do it by hand on the server, put the key on its own line in `~/.ssh/authorized_keys` and set strict permissions. The SSH server ignores keys when the directory or the file is writable by other users:

```bash
mkdir -p ~/.ssh && chmod 700 ~/.ssh
vi ~/.ssh/authorized_keys          # paste the key, one key per line
chmod 600 ~/.ssh/authorized_keys
```

On AlmaLinux and Rocky Linux, if a correct key is still refused, restore the SELinux labels with `restorecon -Rv ~/.ssh`.

## Shorten logins with ~/.ssh/config

A host entry saves you from typing addresses, usernames and key paths. On Windows, the file is `C:\Users\<you>\.ssh\config` and uses the same syntax:

```text
Host pd-fra1
    HostName 203.0.113.10
    User alice
    IdentityFile ~/.ssh/id_ed25519
    IdentitiesOnly yes
```

Now `ssh pd-fra1` connects, and `scp`, `rsync` and Git use the same entry. `IdentitiesOnly yes` stops SSH from offering every key in your agent, which avoids “Too many authentication failures” errors.

## Use your key with PuTTY

PuTTY uses its own `.ppk` key format. Open PuTTYgen, choose **Conversions → Import key**, select your `id_ed25519` file, enter its passphrase and click **Save private key**. In PuTTY, select the `.ppk` file under **Connection → SSH → Auth → Credentials**. If you generated the key in PuTTYgen instead, copy the text from the box labeled “Public key for pasting into OpenSSH authorized_keys file” into the client area.

## Remove a key you no longer trust

If a laptop is lost or a colleague leaves, revoke that key: delete its line from `~/.ssh/authorized_keys` on every server, for every user including root, and remove it from **Account → SSH keys**. If it was your own key, install a new one first so that you keep access.

[← Previous **Secure your server in the first hour**](https://powerdedi.com/docs/secure-your-server)

**Still stuck?**

Customers with an active server open a support ticket: tell us what you tried and an engineer takes it from there, usually within a few hours.

[Open a ticket](https://powerdedi.com/account/support)

## Related guides

[All guides](https://powerdedi.com/docs)

[Security](https://powerdedi.com/docs/category/security)

Updated September 25, 2026

### [Secure your server in the first hour](https://powerdedi.com/docs/secure-your-server)

A first-hour checklist: automatic updates, key-only SSH, a firewall, brute-force protection, backups and 2FA.

4 min read

[Getting started](https://powerdedi.com/docs/category/getting-started)

Updated September 26, 2026

### [Get started with your dedicated server](https://powerdedi.com/docs/getting-started)

From order to first SSH login: choose a server, pay in crypto, connect, then run the first-ten-minutes checklist.

4 min read

[Server management](https://powerdedi.com/docs/category/server-management)

Updated September 25, 2026

### [Use the IPMI/KVM console](https://powerdedi.com/docs/ipmi-kvm-console)

See your server’s screen in the browser, control power, mount an ISO and reach the BIOS, even when the OS won’t boot.

4 min read

---

PowerDedi — Dedicated servers with 10 Gbps unmetered, paid in crypto. Page: https://powerdedi.com/docs/ssh-keys. Index of the site for AI assistants: https://powerdedi.com/llms.txt