ssh-keygen

Generate key pairs, inspect fingerprints and change a private key’s passphrase.

Before you run

Enter a strong passphrase at the prompt. The .pub file is public; the file without .pub is private and must never be uploaded to the server or shared. If the destination key already exists, do not overwrite it unintentionally. Changing the passphrase changes private-key protection, not your server password. Ed25519 availability depends on the server and security policy.

Examples

Create an Ed25519 key pair; prompts let you set a passphrase.

ssh-keygen -t ed25519 -C 'laptop-key' -f ~/.ssh/id_ed25519

Display the public key’s fingerprint for comparison.

ssh-keygen -lf ~/.ssh/id_ed25519.pub

Change the existing private key’s passphrase interactively.

ssh-keygen -p -f ~/.ssh/id_ed25519

Options and examples

-t typeCommon

Choose the key type; ed25519 is a common choice when supported by both sides.

Example

ssh-keygen -t ed25519

-f filenameCommon

Specify the key file. Check the path before creating a key to avoid overwriting an existing key.

Example

ssh-keygen -t ed25519 -f ~/.ssh/lab_key

-C commentCommon

Add a comment to a generated key for identification.

Example

ssh-keygen -t ed25519 -C 'laptop-key'

-b bits

Specify key size for algorithms that support it, such as RSA.

Example

ssh-keygen -t rsa -b 4096

-a rounds

Set the key derivation rounds used to protect a private key with a passphrase.

Example

ssh-keygen -t ed25519 -a 64

-l -f filenameCommon

Show the fingerprint of a key or known-hosts entry.

Example

ssh-keygen -lf ~/.ssh/id_ed25519.pub

-p -f filenameCommon

Change the passphrase of an existing private key interactively.

Example

ssh-keygen -p -f ~/.ssh/id_ed25519

-y -f filename

Print the public key derived from a private key.

Example

ssh-keygen -y -f ~/.ssh/id_ed25519

-F hostname

Find a host in the known_hosts file, including hashed entries.

Example

ssh-keygen -F server.example.com

-R hostname

Remove matching entries from known_hosts. Verify a replacement host key independently before trusting it.

Example

ssh-keygen -R server.example.com

Authoritative references

Reviewed October 27, 2026