Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsSome links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Generate an SSH key pair on your client, place only its public key in the target account’s ~/.ssh/authorized_keys file, then test with ssh user@server. Keep the private key on the client, protect it with a passphrase where practical, and do not disable password authentication until key login works in a separate session.
Client and server: which key goes where?
SSH public-key authentication uses two mathematically related files. The client proves that it possesses the private key; the server checks the matching public key against keys authorized for the remote account.
| Item | Where it belongs | Purpose |
|---|---|---|
| Private key | Client only | Signs the authentication exchange. Treat it as a secret. |
Public key (.pub) |
Server, in the destination account’s authorized-keys file | Lets the server verify signatures made by the matching private key. It is not secret. |
authorized_keys |
Usually ~/.ssh/authorized_keys for the target account |
Contains one or more permitted public keys, one key per line. |
The server’s effective AuthorizedKeysFile setting determines the actual location. Its documented default includes .ssh/authorized_keys below the target user’s home directory, but administrators can change it.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
“Passwordless” means you do not enter the remote account password for each successful key-authenticated login. It does not mean the private key must be unprotected. A passphrase, optionally held by ssh-agent, protects the key if the client is lost or copied.
#1 Best Overall
Prerequisites and a safe rollout
- An SSH client on your workstation or automation host, with permission to run
ssh-keygenandssh. - A reachable Linux server running an SSH daemon and a known account name.
- One currently working login path, normally the account password or an administrative console, for the initial installation.
- A recovery route and an open session before changing daemon authentication policy.
Key exchange does not configure DNS, routing, firewalls, the listening port, or the server daemon. Verify that the server is reachable independently of key authorization.
Step 1: generate a key pair on the client
Run this on the machine from which you will connect, not on the server:
ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519Press Enter to accept the displayed path, or choose a different filename when you need separate identities. Enter a strong passphrase unless an unattended process requires another protection design. The command creates:
~/.ssh/id_ed25519— the private key; never copy this into the server’sauthorized_keys.~/.ssh/id_ed25519.pub— the public key to install.
If your installed OpenSSH version or an older server requires another algorithm, check compatibility before choosing one. Do not assume that one algorithm is universally best across every client and server version.
Step 2: install the public key for the exact account
Use ssh-copy-id
The usual helper appends your public key to the account named in its destination:
ssh-copy-id user@serverIt may ask for the account password once. To select a non-default key explicitly, use the public file:
ssh-copy-id -i ~/.ssh/id_ed25519.pub user@serverThe utility creates the remote .ssh directory or authorized-keys file when necessary. The username matters: installing a key for alice does not authorize root or another account.
Free tools Windows power users keep installed
One-click scans. No signup required.
Install manually when the helper is unavailable
Through an already authenticated administrative path, create the target account’s SSH directory, append the complete contents of the .pub file as one line, and ensure the file uses the standard authorized-key format. Do not wrap a key across lines and do not paste the private key.
cat ~/.ssh/id_ed25519.pubThen append that single line to the correct account’s authorized-keys file on the server. If you are administering another user, verify that the directory and file are owned by that user and are not writable by unintended users. Exact permission requirements depend on the surrounding configuration; correcting ownership and removing unsafe group or other write access is more reliable than applying one universal mode blindly.
Step 3: test key authentication before changing policy
Open a new connection while keeping your existing session available:
ssh user@serverFor a key stored under a non-default name, specify the private key (without .pub):
ssh -i ~/.ssh/production_ed25519 user@serverAfter login, confirm the remote identity with commands such as whoami and hostname. This catches the common mistake of authenticating successfully as the wrong account or against the wrong host.
Use an SSH client configuration for repeat connections
Create or edit ~/.ssh/config on the client:
Host production
HostName server.example.com
User deploy
IdentityFile ~/.ssh/production_ed25519
IdentitiesOnly yesThen connect with:
ssh productionIdentitiesOnly yes helps prevent the client from offering unrelated keys when an agent contains many identities.
Step 4: optionally use an agent instead of retyping the key passphrase
ssh-agent can hold an unlocked private key for the duration supported by your client environment. Add the key with:
ssh-add ~/.ssh/id_ed25519Agent startup and lifetime differ among desktop sessions, shells, operating systems and distributions. Treat an agent as a convenience, not as a reason to remove the private-key passphrase. On shared machines, understand which processes can access the agent socket.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchStep 5: restrict password authentication only after verification
Once a new key-based login succeeds, an administrator may review the effective server configuration. OpenSSH provides controls including PubkeyAuthentication, PasswordAuthentication and AuthenticationMethods. Their interaction can enforce keys, passwords, or a sequence of methods.
Configuration file locations and service reload commands vary by distribution and deployment. Do not rely on a single command copied from another Linux release. Validate the configuration using the tools available on that system, keep an existing session open, and retain console or out-of-band recovery before reloading the daemon. A typo or an incorrect policy can otherwise lock out every remote administrator.
FIDO security keys: an optional hardware-backed method
OpenSSH also supports FIDO security-key algorithms, including security-key forms of Ed25519 and ECDSA. This approach stores or protects key operations on a compatible physical token and can require user presence. The token must be attached when the key is used. Client and server software must support the selected algorithm, and the token must be available for every authentication that needs it. FIDO is optional; ordinary software-held key pairs do not require a hardware token.
When comparing setups, evaluate installed OpenSSH compatibility, whether the private key is software-held or hardware-backed, passphrase and touch requirements, and how you will recover access if a device or token is unavailable.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Troubleshooting: symptom, cause and fix
Password prompt still appears
- Wrong account or host: Check the username in the destination and verify the hostname. The key must be installed in that account’s home directory.
- Wrong identity: Use
ssh -i /path/to/private_key user@server. Select the matching.pubfile withssh-copy-id -i; never substitute the private file. - Client offers another key: Use verbose client output, such as
ssh -v user@server, to see which identities are offered. SetIdentityFileand, when appropriate,IdentitiesOnly yesin the client configuration. - Public-key authentication disabled: Inspect the server’s effective
PubkeyAuthenticationsetting and any included configuration files.
“Permission denied” after the key was copied
- Check the effective
AuthorizedKeysFile; the daemon may be reading a non-default path. - Ensure the public key is complete, valid, and occupies exactly one authorized-keys line.
- Correct ownership of the account’s home,
.sshdirectory and authorized-keys file, and remove unsafe group or other write access as applicable. - Confirm that the account is permitted to log in and that server policy does not require an additional authentication method.
The server cannot be reached
Resolve DNS, routing, firewall rules, port selection and daemon availability first. A key cannot be tested until an SSH connection reaches the server.
Best Value
The key works from one machine but not another
Each client needs access to the corresponding private key, or to an agent that holds it. Compare the selected identity, client configuration and OpenSSH versions rather than generating or installing random additional keys.
Or skip the browser setup:
ScreenshotNeo is a separate website screenshot API and MCP server; it is not required for SSH authentication. If your deployment documentation also needs repeatable page captures, one GET request returns a PNG, JPEG, WebP or PDF:
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpSee the ScreenshotNeo documentation for options. It removes cookie and consent banners, newsletter popups and chat widgets before capture; bot checks, blank pages, timeouts, failed loads and cache hits are not billed, and response headers identify the page verdict and billing result. Its MCP server provides take_screenshot, get_page_info and capture_pdf tools for Claude, Cursor and other MCP clients. The Free plan includes 1,000 screenshots per month with no card; paid plans start at $5 for 3,000 shots. Create a free ScreenshotNeo account.
Operational checklist
- Generate the pair on the client.
- Back up the private key securely and record its passphrase-recovery plan.
- Install only the matching public key for the intended account.
- Test a new connection with the explicit identity when needed.
- Verify the remote username and hostname.
- Keep a working session or console route.
- Review and change server authentication policy only after successful testing.
Frequently Asked Questions
Can I copy the private key to the server?
No. The private key remains on the client; only the corresponding .pub key belongs in the server account’s authorized-keys file.
Does key authentication require removing my account password?
No. You can continue using password authentication, or an administrator can restrict it later after a tested recovery path exists.
Why does ssh-copy-id install the key but login still fails?
Check the destination account, effective AuthorizedKeysFile path, key formatting, ownership and permissions, client identity selection, and whether PubkeyAuthentication or another server policy blocks the login.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
