How to Set Up SSH Key Authentication in Windows 11

Why Use SSH Key Authentication?

SSH keys offer better security than passwords by using complicated codes that are hard to guess. SSH keys remove the need for you to remember or type passwords when connecting to servers. This method saves you time and improves your account security.

What You Need Before Starting

Windows 11 already has the tools you need for SSH key authentication built-in, so you don’t need to download anything extra to get started.

Built-in OpenSSH means you can get started right away without downloading software.

How to Create SSH Keys in 🪟 Windows 11

Step 1Open Windows Terminal

Click the Windows Start button. Type “Windows Terminal” and open it.

You might be wondering why we’re using Windows Terminal. It’s a more secure and user-friendly option compared to the older Command Prompt.

Step 2Generate Your SSH Key Pair

Generating your SSH key pair is the crucial first step for authentication. You accomplish this with a command in Windows Terminal.

The `ssh-keygen` command generates a new SSH key, typically using the Ed25519 algorithm. This is currently the most secure method for SSH keys, recommended by many services.

For older systems, an alternative command creates a secure 4096-bit RSA key.

ssh-keygen -t rsa -b 4096 -C "your-email@example.com"

This creates a 4096-bit RSA key, which is also secure.

Step 3Choose Where to Save Your Key

The command prompts: “Enter a file in which to save the key.”

Press Enter to accept the default location.

Your keys will be saved in a location like this: C:\Users\YourUsername\.ssh (just replace `YourUsername` with your actual Windows account name).

Step 4Add a Passphrase (Optional but Recommended)

Adding a passphrase to your SSH key pair in Windows 11 is optional, but it’s a really good idea for extra security.

You can type a strong password here or leave it blank and press Enter.

An SSH private key passphrase boosts the security of your private key file. Without the correct passphrase, anyone finding your private key file cannot use it. This passphrase protection is crucial for securing server access.

If you add a passphrase, you’ll type it each time you use the key.

Step 5Confirm Key Generation

You’ll know your SSH key pair was successfully generated in Windows 11 when you see a confirmation message in Windows Terminal after running the command.

Your identification has been saved in /home/user/.ssh/id_ed25519.
Your public key has been saved in /home/user/.ssh/id_ed25519.pub.
The key fingerprint is: SHA256:xxxxxxxxxxxxxxxxxxxxx

This means your key pair is ready to use.

Understanding Your SSH Folder Structure

Your SSH keys and associated files reside in a hidden folder named `.ssh` within your Windows 11 user profile.

Folder location: C:\Users\YourUsername\.ssh

Files inside:

• id_ed25519 – Your private key (keep this secret)
• id_ed25519.pub – Your public key (share this)
• authorized_keys – Keys allowed to log in (created later)
• config – Settings for SSH connections (optional)

A dot character (.) at the beginning of a folder name makes it hidden by default in Windows 11. This folder hiding practice keeps your SSH keys out of sight for better security.

File Permissions: Keep Your Keys Safe

Setting the right file permissions for your SSH keys in Windows 11 is super important to keep your private key safe and hidden from others.

• Private key (id_ed25519) should be readable only by you (equivalent to 600)
• Public key (id_ed25519.pub) can be readable by anyone (equivalent to 644)
• The .ssh folder itself should be accessible only by you (equivalent to 700)

On Windows 11, the OpenSSH tool typically manages file permissions automatically for SSH key authentication. This automation means users rarely need to manually change file access settings. OpenSSH version 8.1 and later include these automatic permission checks.

How to Generate Multiple SSH Keys for Different Services

Using distinct SSH keys for different services enhances login security. For example, a user might need a separate SSH key for GitHub, another for work servers, and a third for personal servers. This segregation ensures each key only unlocks the intended destination.

Creating a Second SSH Key

Creating a second SSH key pair in Windows 11 for different uses, like work or personal projects, is easy using a specific command.

ssh-keygen -t ed25519 -C "work-email@company.com" -f "C:\Users\YourUsername\.ssh\id_ed25519_work"

Replace:

• work-email@company.com with your work email
• YourUsername with your Windows account name
• id_ed25519_work with a name for this key

A new SSH key pair, distinct from any existing keys, generates. Windows 11 users can manage multiple key pairs for varied security needs, such as accessing different servers.

Telling SSH Which Key to Use

You can tell SSH which key to use for different servers in Windows 11 by creating a `config` file in your `.ssh` folder.

Host github.com
  HostName github.com
  User git
  IdentityFile C:\Users\YourUsername\.ssh\id_ed25519

Host work-server
  HostName work.example.com
  User workuser
  IdentityFile C:\Users\YourUsername\.ssh\id_ed25519_work

Replace the paths and hostnames with your actual information.

Save this file as `config` (without any file extension) in your `.ssh` folder.

SSH key authentication automatically selects the correct private key file when a Windows 11 computer connects to a remote server. This setup uses a unique key pair, with the public key on the server and the private key on the user's machine, to verify identity without a password for increased security and convenience during server access.

Adding Your Key to the SSH Agent

The SSH Agent remembers your keys so you don’t type your passphrase repeatedly.

Step 1Start the SSH Agent

Step 1: Start the SSH Agent. Begin by opening Windows Terminal as an administrator. To do this, right-click the ⊞ Start button and select “Run as Administrator.”

⚠️ Note: This step requires administrator privileges. Type the following command and then press Enter:

Set-Service -Name ssh-agent -StartupType Automatic

Then press Enter.

Next, start the service:

Start-Service ssh-agent

The SSH Agent service starts and will remember your keys.

Step 2Add Your Key to the Agent

In the same Terminal window, run:

ssh-add C:\Users\YourUsername\.ssh\id_ed25519

Replace YourUsername with your actual Windows account name.

If you set a passphrase, type it when asked.

The SSH private key, stored in the SSH agent, eliminates the need to re-enter the passphrase during a computer session. This single loading action enhances both security and user convenience by avoiding repeated manual input of sensitive information for SSH connections.

Copying Your Public Key to a Server

The SSH public key on the server confirms your identity. Think of this public key file as a physical key that grants server access by authorizing a connection.

Method 1Using PowerShell (Easiest)

The easiest way to add your SSH public key to a remote server from Windows 11 is by using a simple PowerShell command.

type $env:USERPROFILE\.ssh\id_ed25519.pub | ssh user@192.168.1.100 "cat >> ~/.ssh/authorized_keys"

Replace:

• user with your username on the remote server
• 192.168.1.100 with the server’s IP address

Type your password when prompted.

Your public key is then copied to the server and appended to the `authorized_keys` file. The server will now accept your key.

Method 2Manual Copy (If Method 1 Doesn’t Work)

If the PowerShell method fails, manually copy your SSH public key from Windows 11 into the server’s `authorized_keys` file. First, copy the entire output, which appears as a long, jumbled line. Next, log into your server using SSH and your password. Once logged in, create the `.ssh` folder if it doesn’t already exist. Then, create the `authorized_keys` file and paste your public key into it. Remember to replace `YOUR_PUBLIC_KEY_HERE` with the key you copied. Finally, set the correct permissions for the file. These commands ensure only you can read your `authorized_keys` file.

type $env:USERPROFILE\.ssh\id_ed25519.pub

Copy the entire output (it looks like a long jumbled line).

Then, log into your server with SSH and password:

ssh user@192.168.1.100

On the server, create the `.ssh` folder if it doesn’t already exist.

mkdir -p ~/.ssh

Then, create the `authorized_keys` file and paste your public key into it:

echo "YOUR_PUBLIC_KEY_HERE" >> ~/.ssh/authorized_keys

Remember to replace `YOUR_PUBLIC_KEY_HERE` with the key you copied.

Finally, set the correct permissions for the file.

chmod 600 ~/.ssh/authorized_keys
chmod 700 ~/.ssh

These commands ensure only you can read your `authorized_keys` file.

Understanding the authorized_keys File

The `authorized_keys` file on your server is a security list that holds all the public SSH keys allowed to log in.

Location on server: ~/.ssh/authorized_keys (usually in your home folder)

File format: Each public key takes up one line and starts with “ssh-ed25519” or “ssh-rsa”

Authorized keys on the server control login access, preventing unauthorized connections. This security measure ensures only listed keys can connect, safeguarding the server.

How to Disable Password Authentication

Once your keys are working, you can turn off password logins for extra security.

Testing your SSH key verifies proper SSH key authentication before you continue. A successful SSH key test confirms the SSH key setup works. If you skip testing your SSH key, you risk losing access to your server.

Step 1Log Into Your Server

Connect with SSH:

ssh user@192.168.1.100

If your key is working, you should log in without entering a password.

Step 2Edit the SSH Configuration File

On the server, open the SSH config file with a text editor:

sudo nano /etc/ssh/sshd_config

⚠️ Requires Admin Privileges on the Remote Server

Type your password if prompted.

Step 3Find and Change These Lines

Look for these lines in the file (they might have a # at the start):

PasswordAuthentication yes
PubkeyAuthentication yes
PermitEmptyPasswords no

Change them to:

PasswordAuthentication no
PubkeyAuthentication yes
PermitEmptyPasswords no

This turns off password login but keeps SSH key login enabled.

Step 4Save and Restart SSH

Press Ctrl+X, then Y, then Enter to save in Nano.

🔄 Restart the SSH service:

sudo systemctl restart ssh

⚠️ Requires Admin Privileges on the Remote Server

SSH will now only accept key-based login, not passwords.

Creating an SSH Config File on 🪟 Windows 11

A config file makes connecting to servers easier by saving settings.

Create Your Config File

Creating a `config` file in your `.ssh` folder on Windows 11 lets you set up shortcuts and choose which SSH keys to use for different servers.

Host myserver
  HostName 192.168.1.100
  User myusername
  IdentityFile C:\Users\YourUsername\.ssh\id_ed25519
  Port 22

Host github
  HostName github.com
  User git
  IdentityFile C:\Users\YourUsername\.ssh\id_ed25519

Replace:

• myserver with a nickname for this server
• 192.168.1.100 with the server IP
• myusername with your username
• YourUsername with your Windows account

Save this file as `config` (no .txt) in C:\Users\YourUsername\.ssh

Using Your Config File

Now you can connect by just typing:

ssh myserver

Instead of the long command with IP address and username.

Config files save time and reduce mistakes.

Troubleshooting SSH Key Authentication Problems

Problem: “Permission Denied (publickey)”

Troubleshooting SSH Key Authentication Problems. Problem: “Permission Denied (publickey)”. If you encounter a ‘Permission Denied (publickey)’ error when connecting via SSH in Windows 11, it typically means the server cannot locate or verify your key.

How to fix it:

1. Check that your public key is in the server’s ~/.ssh/authorized_keys file
2. Make sure file permissions are correct: chmod 600 ~/.ssh/authorized_keys
3. Verify you’re using the right key: ssh -i C:\Users\YourUsername\.ssh\id_ed25519 user@192.168.1.100

Problem: “No Such File or Directory: .ssh”

What it means: The .ssh folder doesn’t exist yet.

How to fix it:

On Windows, run:

mkdir $env:USERPROFILE\.ssh

On the remote server, run:

mkdir -p ~/.ssh

Problem: “Too Many Authentication Failures”

What it means: You tried too many wrong keys or passwords.

How to fix it:

1. Wait a few minutes before trying again
2. Specify which key to use: ssh -i C:\Users\YourUsername\.ssh\id_ed25519 user@192.168.1.100
3. Check your SSH config file for errors