Generate SSH Keys on Windows 11: A Step-by-Step Guide

SSH keys on Windows 11 are a pair of secure digital codes that let you sign in to servers and code-hosting sites like GitHub without typing a password. The pair has two halves. Your public key goes on the remote server. Your private key stays on your PC in the 📁C:\Users\USERNAME\copy.ssh folder, and you should never share it.

Windows 11 includes a built-in OpenSSH client, so you do not need to download extra software. You can create your keys in a few minutes using PowerShell, Command Prompt, or Windows Terminal. All three run the same tool, so use whichever you already have open.

If Windows says the command is not recognized, the OpenSSH Client feature may not be installed. Go to Settings › System › Optional features, check whether OpenSSH Client is in the installed list, and add it if it is missing. Then close and reopen your terminal.

How to create SSH keys in 🪟 Windows 11

You can generate SSH keys on Windows 11 quickly by opening Command Prompt or PowerShell and running the built-in key tool. It creates a public and private key pair on your computer. You can then log in to servers without typing your account password each time.

The steps below show you how to do that on Windows 11.

1. Right-click the Start button and choose Terminal. You can also search for PowerShell or Command Prompt. You should see a window with a command prompt waiting for input.
2. Type or paste the command shown below, then press Enter.

ssh-keygen

This command creates an RSA key pair. The original version of this guide describes it as a 2048-bit key. The default size can differ with the OpenSSH version on your PC, and newer builds may use a longer key. RSA is still widely supported, which makes it a good choice for older servers.

GitHub recommends generating an SSH key with the Ed25519 algorithm instead. Ed25519 keys are shorter and fast, and they are considered a strong modern choice. Use this command if the server or service you connect to supports it, which GitHub does.

ssh-keygen -t ed25519 -C "your_email@example.com"

When you run either command, the tool asks where to save the key file. You should see a line like the one in the screenshot below.

1. Read the prompt “Enter a file in which to save the key“.
2. Press Enter to accept the default file location. The tool then moves on to the next question.

Generating public/private ed25519 key pair.
Enter file in which to save the key (C:\Users\Richard/.ssh/id_ed25519):

If you use the defaults, your keys are saved in C:\Users\<username>\.ssh. Accepting the default is the right choice for most people. Programs such as Git and the OpenSSH client look in that folder automatically. If you type a different name or path, you will have to tell those programs where your key is.

If a key with that name already exists, the tool asks whether you want to overwrite it. Answer carefully. Overwriting replaces your old private key, and any server that trusts the old public key will refuse you until you add the new one.

Next, you are asked to enter a passphrase. Many people leave this empty and press Enter, which is why the original guide says you typically do. However, a passphrase adds a second layer of protection. If someone copies your private key file, they still cannot use it without the passphrase. The trade-off is that you are asked for the passphrase every time the key is used to authenticate. You will be asked to type it a second time to confirm. The characters do not show as you type, which is normal.

Created directory 'C:\Users\Richard/.ssh'.
Enter passphrase (empty for no passphrase):

After that, you should see a screen similar to the one below. It confirms the key was saved and shows a fingerprint of the key. Your SSH key pair is now created and ready to use.

Generating public/private ed25519 key pair.
Enter file in which to save the key (C:\Users\Richard/.ssh/id_ed25519):
Created directory 'C:\Users\Richard/.ssh'.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in C:\Users\Richard/.ssh/id_ed25519.
Your public key has been saved in C:\Users\Richard/.ssh/id_ed25519.pub.
The key fingerprint is:
SHA256:fXTi96BC8pHrLtqyBOrtKBeWvYSMigOKt9U898rd1Jo admin@example.com
The key's randomart image is:
+--[ED25519 256]--+
|                 |
|                 |
|            o .  |
|         . + o   |
| o +.   S = o o  |
|o *.o+   + + + o |
|*..o..= . + o . .|
|B.o+...=.+ + o   |
| =+oo o+++= E    |
+----[SHA256]-----+

Once key generation is complete, you can find the key pair at the location below. Open File Explorer and go to the folder, or use the path in your terminal.

C:\Users\<username>\.ssh

Replace <username> with your Windows account name.

Inside the folder you will see two files for each key. The file with no extension is your private key. Keep it on this PC and do not email it or paste it anywhere. The file ending in .pub is your public key. This is the one you copy into GitHub or onto a server. If the .ssh folder looks empty, check that you are looking in your own user profile and that the key was saved to the default location.

To undo all of this, delete the two key files from the folder. Also remove the public key from any server or GitHub account where you added it. You can then generate a fresh pair at any time.

That should do it!

Conclusion:

• Generating SSH keys in Windows 11 is straightforward with the built-in OpenSSH tools, and no restart is needed.
• Using the Ed25519 algorithm for SSH key generation is recommended for enhanced security.
• Remember to save your keys in a secure location and choose a passphrase for added protection.
• Once created, your SSH key pair can be easily accessed in the .ssh directory of your user profile.
• Having SSH keys enables secure and convenient authentication when connecting to servers or using platforms like GitHub.