How to Generate Secure SSH Keys on macOS 13

This guide provides a straightforward walkthrough for creating modern, cryptographically secure SSH key pairs on macOS 13 (Ventura). You will learn how to generate an Ed25519 key pair using the Terminal, configure the macOS Keychain to securely store your passphrase, and transfer your public key to a remote server for passwordless authentication.

Step 1: Open Terminal

Launch the Terminal application on your Mac. You can find it by pressing Command + Space to open Spotlight, typing "Terminal", and pressing Enter.

Step 2: Run the Key Generation Command

The most secure and efficient algorithm currently recommended is Ed25519. Generate your key pair by entering the following command, replacing the placeholder with your actual email address or a label to identify the device:

ssh-keygen -t ed25519 -C "your_email@example.com"

Note: If you are connecting to a legacy system that does not support Ed25519, generate a 4096-bit RSA key instead using ssh-keygen -t rsa -b 4096 -C "your_email@example.com".

Step 3: Specify Key Location and Passphrase

  1. File Location: The prompt will ask where to save the key:

    Enter file in which to save the key (/Users/username/.ssh/id_ed25519):

    Press Enter to accept the default file path and name.

  2. Passphrase: Enter a strong passphrase when prompted, then confirm it. A passphrase adds an essential layer of local encryption to your private key. Do not leave it blank.

Your private key (id_ed25519) and public key (id_ed25519.pub) are now generated in your ~/.ssh/ directory.

Step 4: Configure the SSH Agent and macOS Keychain

To prevent macOS from repeatedly asking for your passphrase every time you connect to a server, configure the SSH agent to use the native macOS Keychain.

  1. Create or edit your SSH config file:

    nano ~/.ssh/config

  2. Add the following lines to the file:

    Host *
  AddKeysToAgent yes
  UseKeychain yes
  IdentityFile ~/.ssh/id_ed25519

  3. Save and exit by pressing Control + O, then Enter, and finally Control + X.

  4. Add your private key to the SSH agent and store the passphrase in the macOS Keychain:

    ssh-add --apple-use-keychain ~/.ssh/id_ed25519

    Enter your passphrase one final time when prompted.

Step 5: Copy the Public Key to Your Remote Server

You must install your public key on the remote server before you can log in securely.

Method A: Using ssh-copy-id (Recommended) If available on your server, run:

ssh-copy-id username@remote_host

Authenticate with your remote user password. The tool will automatically place your public key into the server's ~/.ssh/authorized_keys file.

Method B: Manual Copy via Clipboard If ssh-copy-id is unavailable:

  1. Copy the public key to your macOS clipboard:

    pbcopy < ~/.ssh/id_ed25519.pub

  2. Log into your remote server using your existing credentials.

  3. Append the clipboard content to ~/.ssh/authorized_keys on the server:

    echo "PASTE_KEY_HERE" >> ~/.ssh/authorized_keys

  4. Ensure correct file permissions on the server:

    chmod 700 ~/.ssh && chmod 600 ~/.ssh/authorized_keys

Step 6: Test Your SSH Connection

Connect to your remote server to ensure the authentication works without prompting for your server account password:

ssh username@remote_host

If configured properly, your Mac will unlock the private key via the Keychain and connect you to the server instantly.