Password-based SSH login is both less secure and more annoying than key-based authentication, yet plenty of servers still have it enabled by default. Setting up keys properly takes about five minutes and you’ll never look back.
Generating a Key Pair
# Ed25519 is the modern recommendation: smaller, faster, and just as secure as RSA-4096 ssh-keygen -t ed25519 -C "you@example.com" # On older systems that don't support Ed25519, use RSA with a strong length ssh-keygen -t rsa -b 4096 -C "you@example.com"
Copying the Public Key to a Server
# The easy way, from Linux/macOS or WSL ssh-copy-id user@server.example.com # Manually, if ssh-copy-id isn't available (e.g. from native Windows) type $env:USERPROFILE\.ssh\id_ed25519.pub | ssh user@server.example.com "cat >> ~/.ssh/authorized_keys"
Disabling Password Authentication
Once you’ve confirmed key-based login works, disable passwords entirely on the server side — this alone eliminates the entire category of brute-force SSH attacks that constantly hammer any internet-facing server:
sudo sed -i 's/#\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config sudo systemctl restart sshd
Using an SSH Agent to Avoid Retyping Your Passphrase
Always protect your private key with a passphrase, and use ssh-agent (or Windows’ built-in OpenSSH agent service) to unlock it once per session rather than typing it on every connection:
eval "$(ssh-agent -s)" ssh-add ~/.ssh/id_ed25519