Run ssh-keygen on macOS to create an SSH key. The right command is ssh-keygen -t ed25519 -C "alice@macbook". The right location is ~/.ssh/id_ed25519. The right answer is to set a passphrase and to use the macOS Keychain for persistence. The team that has this set up has passwordless SSH that works across reboots.
Table of contents
- The right ssh-keygen command
- The right file location
- The right passphrase
- The right ~/.ssh/config
- Adding the key to a server
- FAQ
The right ssh-keygen command
The right command on macOS:
ssh-keygen -t ed25519 -C "alice@macbook"The -t flag is the key type. The -C flag is a comment that goes into the public key. The right answer is to set the comment to your email or a description of the machine.
The right file location
The default is ~/.ssh/id_ed25519 (private) and ~/.ssh/id_ed25519.pub (public). The right answer is to use the default unless you have a specific reason to override. The right file mode is chmod 600 ~/.ssh/id_ed25519 (private) and chmod 644 ~/.ssh/id_ed25519.pub (public).
The right passphrase
The right answer is to set a passphrase. The wrong answer is to leave the passphrase empty — that removes the protection of the key. The right way to avoid retyping the passphrase is the macOS Keychain:
ssh-add --apple-use-keychain ~/.ssh/id_ed25519The right ~/.ssh/config
The right way to use the new key is to configure the SSH client. The minimum config:
Host *
AddKeysToAgent yes
UseKeychain yes
IdentityFile ~/.ssh/id_ed25519With this config, the SSH client automatically adds the key to the agent and uses the macOS Keychain for the passphrase.
Adding the key to a server
The right way is ssh-copy-id alice@server. The right answer is to do this once per server, not on every connection. The wrong answer is to copy the private key to the server — the public key is the only one that should ever leave your machine.
FAQ
Where does ssh-keygen save the key by default?
~/.ssh/id_<type>. The right answer is to use the default unless you have a specific reason.
Can I use a different key type?
Yes. The right answer for new keys is Ed25519. The right answer for legacy compatibility is RSA with -t rsa -b 4096.
How do I see the public key?
cat ~/.ssh/id_ed25519.pub. The right answer is to copy this to the server’s authorized_keys.
What if I forget the passphrase?
Generate a new key. The right answer is to remember the passphrase or to use the macOS Keychain.
Can I have multiple keys?
Yes. Generate one per service and use IdentityFile per host in ~/.ssh/config.
What is the comment for?
It identifies the key when you see it in authorized_keys on a server. The right answer is to set it to something identifiable.
Why does ssh-copy-id not work?
On older macOS, install via Homebrew: brew install ssh-copy-id.
What is the right way to add to GitHub?
Copy the public key to the clipboard with pbcopy < ~/.ssh/id_ed25519.pub and paste into GitHub → Settings → SSH and GPG keys.
If you are sizing the infrastructure for the kind of project this post covers, the RunxBuild hosting calculator is the right place to model the line items. The compute, the memory, the storage, the bandwidth, the database - each one is a separate number, and the team’s mental model for the platform is the sum of those numbers. The RunxBuild dashboard is where the team sees the actual usage in one place.
Useful related references: