How to set up SSH keys for passwordless, secure login

SSH keys replace passwords with a pair of cryptographic files. They're both more secure — effectively impossible to brute-force — and more convenient, because once set up you log in with no password at all.

How key authentication works

A key pair has two halves:

• A private key that stays on your computer and is never shared.
• A public key that you copy to the server.

When you connect, the server challenges your machine to prove it holds the matching private key. It does, without the private key ever leaving your computer. No secret travels over the network, so there's nothing to intercept or guess.

Step 1: Generate a key pair

On your local machine (macOS, Linux, or Windows PowerShell), create a modern Ed25519 key:

ssh-keygen -t ed25519 -C "you@example.com"

Press Enter to accept the default location (~/.ssh/id_ed25519). You'll be offered a passphrase — set one. It encrypts the private key on disk, so a stolen laptop doesn't hand over server access.

This creates two files:

• ~/.ssh/id_ed25519 — the private key (guard it).
• ~/.ssh/id_ed25519.pub — the public key (safe to share).

Step 2: Copy the public key to your VPS

The easy way, from your local machine:

ssh-copy-id deploy@YOUR_SERVER_IP

Enter your password one last time. This appends your public key to ~/.ssh/authorized_keys on the server with correct permissions.

If ssh-copy-id isn't available (some Windows setups), do it manually. Show your public key:

cat ~/.ssh/id_ed25519.pub

Then on the server:

mkdir -p ~/.ssh && chmod 700 ~/.ssh
echo "PASTE_YOUR_PUBLIC_KEY_HERE" >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys

Permissions matter — SSH refuses keys if .ssh or authorized_keys are too open.

Step 3: Test key login

Open a new terminal and connect:

ssh deploy@YOUR_SERVER_IP

If you set a passphrase you'll be asked for it locally (not the account password). You're in — no server password needed. Keep the old session open until this works.

Step 4: Disable password authentication

Now that keys work, turn passwords off so brute-force attempts are pointless. Edit /etc/ssh/sshd_config:

PasswordAuthentication no
PubkeyAuthentication yes

Reload SSH:

sudo systemctl restart ssh

Stop typing your passphrase: the SSH agent

The agent holds your unlocked key for the session so you enter the passphrase once:

eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519

Managing multiple servers

Add hosts to ~/.ssh/config so each one points at the right key:

Host myvps
    HostName YOUR_SERVER_IP
    User deploy
    IdentityFile ~/.ssh/id_ed25519

Then simply ssh myvps.

A few good habits

• Back up your private key — lose it and you lose access.
• Never paste a private key anywhere or commit it to Git.
• Use a separate key per device so you can revoke one without touching the others.

On Nxeon you can add your public key at deploy time so a new VPS comes up already accepting your key — no password step at all. Keys are the single biggest, easiest security upgrade you can make to a server.