How to Set Up SSH Key Authentication in Windows 11

Why Use SSH Key Authentication?

SSH keys offer better security than passwords by using complex codes that are hard to guess. These keys remove the need for users to remember or type passwords when connecting to servers. This method saves time and improves account security.

What You Need Before Starting

Windows 11 already has the tools you need for SSH key authentication built-in, so you don’t need to download anything extra to get started.

Built-in OpenSSH means you can get started right away without downloading software.

How to Create SSH Keys in 🪟 Windows 11

Step 1Open Windows Terminal

Click the Windows Start button. Type “Windows Terminal” and open it.

You might be wondering why we’re using Windows Terminal. It’s a more secure and user-friendly option compared to the older Command Prompt.

Step 2Generate Your SSH Key Pair

Generating your SSH key pair in Windows 11 is the first step for SSH key authentication, and you do this using a straightforward command in Windows Terminal.

The `ssh-keygen` command generates a new SSH key using the Ed25519 algorithm. Ed25519 is the newest and most secure method available for SSH keys. GitHub and other services recommend using Ed25519 for authentication.

If your computer is older, you can use this command instead:

ssh-keygen -t rsa -b 4096 -C "your-email@example.com"

This creates a 4096-bit RSA key, which is also secure.

Step 3Choose Where to Save Your Key

The command will ask: “Enter a file in which to save the key”

Press Enter to accept the default location.

Your keys will be saved in a location like this: C:\Users\YourUsername\.ssh (just replace `YourUsername` with your actual Windows account name).

Step 4Add a Passphrase (Optional but Recommended)

Adding a passphrase to your SSH key pair in Windows 11 is optional, but it’s a really good idea for extra security.

You can type a strong password here or leave it blank and press Enter.

If you add a passphrase, you’ll type it each time you use the key.

Step 5Confirm Key Generation

You’ll know your SSH key pair was successfully generated in Windows 11 when you see a confirmation message in Windows Terminal after running the command.

Your identification has been saved in /home/user/.ssh/id_ed25519.
Your public key has been saved in /home/user/.ssh/id_ed25519.pub.
The key fingerprint is: SHA256:xxxxxxxxxxxxxxxxxxxxx

This means your key pair is ready to use.

Understanding Your SSH Folder Structure

Your SSH keys and related files are kept in a hidden folder called `.ssh` inside your user profile on Windows 11.

Folder location: C:\Users\YourUsername\.ssh

Files inside:

• id_ed25519 – Your private key (keep this secret)
• id_ed25519.pub – Your public key (share this)
• authorized_keys – Keys allowed to log in (created later)
• config – Settings for SSH connections (optional)

The dot character (.) in a folder name makes that folder hidden on Windows 11. This folder hiding practice keeps your SSH keys out of sight for better security.

File Permissions: Keep Your Keys Safe

Setting the right file permissions for your SSH keys in Windows 11 is super important to keep your private key safe and hidden from others.

• Private key (id_ed25519) should be readable only by you (equivalent to 600)
• Public key (id_ed25519.pub) can be readable by anyone (equivalent to 644)
• The .ssh folder itself should be accessible only by you (equivalent to 700)

If permissions are wrong, SSH will refuse to use your key for security reasons.

On Windows 11, the OpenSSH tool typically manages file permissions automatically for SSH key authentication. This automation means users rarely need to manually change file access settings. OpenSSH version 8.1 and later include these automatic permission checks.

How to Generate Multiple SSH Keys for Different Services

Restricting SSH keys to specific services creates a safer login method. For example, a user might need a separate SSH key for GitHub, another for work servers, and a third for personal servers. This segregation ensures each key only unlocks the intended destination.

Creating a Second SSH Key

Creating a second SSH key pair in Windows 11 for different uses, like work or personal projects, is easy using a specific command.

ssh-keygen -t ed25519 -C "work-email@company.com" -f "C:\Users\YourUsername\.ssh\id_ed25519_work"

Replace:

• work-email@company.com with your work email
• YourUsername with your Windows account name
• id_ed25519_work with a name for this key

A new SSH key pair, distinct from any existing keys, generates. Windows 11 users can manage multiple key pairs for varied security needs, such as accessing different servers.

Telling SSH Which Key to Use

You can tell SSH which key to use for different servers in Windows 11 by creating a `config` file in your `.ssh` folder.

Host github.com
  HostName github.com
  User git
  IdentityFile C:\Users\YourUsername\.ssh\id_ed25519

Host work-server
  HostName work.example.com
  User workuser
  IdentityFile C:\Users\YourUsername\.ssh\id_ed25519_work

Replace the paths and hostnames with your actual information.

Save this file as `config` (without any file extension) in your `.ssh` folder.

SSH key authentication automatically selects the correct private key file when a Windows 11 computer connects to a remote server. This setup uses a unique key pair, with the public key on the server and the private key on the user's machine, to verify identity without a password for increased security and convenience during server access.

Adding Your Key to the SSH Agent

The SSH Agent remembers your keys so you don’t type your passphrase repeatedly.

Step 1Start the SSH Agent

Open Windows Terminal as Administrator (right-click and select “Run as Administrator”).

⚠️ Note: This step requires administrator privileges. Type the following command and then press Enter:

Set-Service -Name ssh-agent -StartupType Automatic

Then press Enter.

Next, start the service:

Start-Service ssh-agent

The SSH Agent service starts and will remember your keys.

Step 2Add Your Key to the Agent

In the same Terminal window, run:

ssh-add C:\Users\YourUsername\.ssh\id_ed25519

Replace YourUsername with your actual Windows account name.

If you set a passphrase, type it when asked.

The SSH private key, stored in the SSH agent, eliminates the need to re-enter the passphrase during a computer session. This single loading action enhances both security and user convenience by avoiding repeated manual input of sensitive information for SSH connections.

Copying Your Public Key to a Server

The SSH public key on the SSH server verifies user identity. This public key file acts like a physical key, granting server access by allowing a connection.

Method 1Using PowerShell (Easiest)

The easiest way to add your SSH public key to a remote server from Windows 11 is by using a simple PowerShell command.

type $env:USERPROFILE\.ssh\id_ed25519.pub | ssh user@192.168.1.100 "cat >> ~/.ssh/authorized_keys"

Replace:

• user with your username on the remote server
• 192.168.1.100 with the server’s IP address

Type your password when prompted.

Your public key is then copied to the server and appended to the `authorized_keys` file. The server will now accept your key.

Method 2Manual Copy (If Method 1 Doesn’t Work)

If the easy PowerShell method doesn’t work, you can manually copy your SSH public key from Windows 11 to the server’s `authorized_keys` file.

type $env:USERPROFILE\.ssh\id_ed25519.pub

Copy the entire output (it looks like a long jumbled line).

Then, log into your server with SSH and password:

ssh user@192.168.1.100

On the server, create the SSH folder if it doesn’t exist:

mkdir -p ~/.ssh

Create the authorized_keys file and paste your public key:

echo "YOUR_PUBLIC_KEY_HERE" >> ~/.ssh/authorized_keys

Replace YOUR_PUBLIC_KEY_HERE with what you copied earlier.

Set correct permissions:

chmod 600 ~/.ssh/authorized_keys
chmod 700 ~/.ssh

These commands make sure only you can read your authorized_keys file.

Understanding the authorized_keys File

The `authorized_keys` file on your server is a security list that holds all the public SSH keys allowed to log in.

Location on server: ~/.ssh/authorized_keys (usually in your home folder)

File format: Each public key takes up one line and starts with “ssh-ed25519” or “ssh-rsa”

Authorized keys on the server control login access, preventing unauthorized connections. This security measure ensures only listed keys can connect, safeguarding the server.

How to Disable Password Authentication

Once your keys are working, you can turn off password logins for extra security.

Testing the SSH key verifies proper authentication before continuing. A successful SSH key test confirms the setup works. Skipping this test risks losing access to your server.

Step 1Log Into Your Server

Connect with SSH:

ssh user@192.168.1.100

If your key is working, you should log in without entering a password.

Step 2Edit the SSH Configuration File

On the server, open the SSH config file with a text editor:

sudo nano /etc/ssh/sshd_config

⚠️ Requires Admin Privileges on the Remote Server

Type your password if prompted.

Step 3Find and Change These Lines

Look for these lines in the file (they might have a # at the start):

PasswordAuthentication yes
PubkeyAuthentication yes
PermitEmptyPasswords no

Change them to:

PasswordAuthentication no
PubkeyAuthentication yes
PermitEmptyPasswords no

This turns off password login but keeps SSH key login enabled.

Step 4Save and Restart SSH

Press Ctrl+X, then Y, then Enter to save in Nano.

🔄 Restart the SSH service:

sudo systemctl restart ssh

⚠️ Requires Admin Privileges on the Remote Server

SSH will now only accept key-based login, not passwords.

Creating an SSH Config File on 🪟 Windows 11

A config file makes connecting to servers easier by saving settings.

Create Your Config File

Creating a `config` file in your `.ssh` folder on Windows 11 lets you set up shortcuts and choose which SSH keys to use for different servers.

Host myserver
  HostName 192.168.1.100
  User myusername
  IdentityFile C:\Users\YourUsername\.ssh\id_ed25519
  Port 22

Host github
  HostName github.com
  User git
  IdentityFile C:\Users\YourUsername\.ssh\id_ed25519

Replace:

• myserver with a nickname for this server
• 192.168.1.100 with the server IP
• myusername with your username
• YourUsername with your Windows account

Save this file as `config` (no .txt) in C:\Users\YourUsername\.ssh

Using Your Config File

Now you can connect by just typing:

ssh myserver

Instead of the long command with IP address and username.

Config files save time and reduce mistakes.

Troubleshooting SSH Key Authentication Problems

Problem: “Permission Denied (publickey)”

If you see a ‘Permission Denied (publickey)’ error when connecting via SSH in Windows 11, it usually means the server can’t find or check your key.

How to fix it:

1. Check that your public key is in the server’s ~/.ssh/authorized_keys file
2. Make sure file permissions are correct: chmod 600 ~/.ssh/authorized_keys
3. Verify you’re using the right key: ssh -i C:\Users\YourUsername\.ssh\id_ed25519 user@192.168.1.100

Problem: “No Such File or Directory: .ssh”

What it means: The .ssh folder doesn’t exist yet.

How to fix it:

On Windows, run:

mkdir $env:USERPROFILE\.ssh

On the remote server, run:

mkdir -p ~/.ssh

Problem: “Too Many Authentication Failures”

What it means: You tried too many wrong keys or passwords.

How to fix it:

1. Wait a few minutes before trying again
2. Specify which key to use: ssh -i C:\Users\YourUsername\.ssh\id_ed25519 user@192.168.1.100
3. Check your SSH config file for errors