How do I generate an SSH key on Windows?
Generate the key pair locally with ssh-keygen, then enrol only its public half on the server. Choose a distinct filename so that creating a new key cannot accidentally replace a key already used elsewhere.
Instructions
1. Check the intended key path
Make sure the .ssh directory belongs to your Windows account and that the new filename is unused.
New-Item -ItemType Directory -Path "$env:USERPROFILE\.ssh" -Force
Test-Path -LiteralPath "$env:USERPROFILE\.ssh\server_ed25519"Creating the directory leaves existing directory contents in place. If the key path already exists, choose another name.
2. Generate the key interactively
Enter a strong passphrase at the prompt. Do not place it in the command line or a script.
ssh-keygen -t ed25519 -f "$env:USERPROFILE\.ssh\server_ed25519" -C "server-access"-t selects Ed25519, -f chooses the filename, and -C adds a nonsecret descriptive label.
3. Record the public fingerprint
The private key has no .pub suffix. The .pub file is the part to enrol.
ssh-keygen -lf "$env:USERPROFILE\.ssh\server_ed25519.pub"Record this fingerprint to distinguish the key from other keys during enrolment and rotation.
Check the result
- Two matching files exist: the private key and its .pub public key.
- The public-key fingerprint is recorded without displaying the private key.
Troubleshooting
- The tool asks to overwrite a file
- Cancel unless replacing that exact key is deliberate and access consequences have been assessed.
- The server does not accept Ed25519
- Check the server’s cryptographic policy and supported algorithms before selecting an approved alternative.
Official references
Use the documentation for your installed version when a flag, service name or platform feature differs.