An SSH key is the right way to log in to a Linux VPS. It is far harder to guess than any password, it lets you turn password logins off completely, and once it is loaded you never type a server password again. This SSH key VPS guide shows how to create an ed25519 key on Windows, macOS and Linux, add it before you deploy so the server trusts it from the first boot, log in, and fix the errors people hit most often.
If you are still choosing where to run the server, the VPS locations guide covers every region Cloudj offers.
How SSH keys work in one paragraph
ssh-keygen creates a pair of files. The private key (for example id_ed25519) stays on your computer and never leaves it. The public key (id_ed25519.pub) is safe to share; you put it on servers you want to access, in a file called ~/.ssh/authorized_keys. When you connect, the server checks that you hold the private key matching one of its public keys, without the private key ever crossing the network. Protect the private key with a passphrase so a stolen laptop does not mean stolen servers.
Step 1: create the key
Ed25519 is the modern default: short keys, fast, and supported by every current OpenSSH release. Use RSA with 4096 bits only for very old systems that do not accept ed25519.
On macOS and Linux
Open Terminal and run:
ssh-keygen -t ed25519 -C "your-name@laptop"Press Enter to accept the default path ~/.ssh/id_ed25519, then type a passphrase. The -C comment is only a label that helps you recognise the key later.
On Windows 10 and 11
Windows ships the OpenSSH client. Open PowerShell (not as administrator) and run the same command:
ssh-keygen -t ed25519 -C "your-name@laptop"The key is saved in C:\Users\YOUR_USER\.ssh\. If ssh-keygen is not found, add the optional feature "OpenSSH Client" in Settings under System, Optional features.
Show the public key
You need the contents of the .pub file in the next step. On macOS and Linux:
cat ~/.ssh/id_ed25519.pubOn Windows PowerShell:
Get-Content $env:USERPROFILE\.ssh\id_ed25519.pubIt is a single line that starts with ssh-ed25519. Copy the whole line. Never paste the file without .pub; that is your private key.
Step 2: add the SSH key to your VPS before you deploy
The cleanest setup is to give the server your key at creation time. In the Cloudj console, add your public key to your account, then select it when you deploy a Linux server. The server boots with the key already in root's authorized_keys, so your first login is key-based.
Cloudj also generates a root password that you can view on the server page. You can use SSH keys, the password or both. Our recommendation is to log in with the key, then turn password logins off as part of the first-hour security checklist. Windows servers are different: they use password login over RDP, so this guide does not apply to them.
Step 3: log in
Use the server's public IP from the console:
ssh [email protected]The first time, SSH asks you to confirm the server's fingerprint. Type yes. From then on, SSH warns you if the fingerprint changes, which protects you against connecting to an impostor.
If your key is not at the default path, point to it:
ssh -i ~/.ssh/cloudj_ed25519 [email protected]Step 4: save typing with a config file
Create or edit ~/.ssh/config (on Windows, C:\Users\YOUR_USER\.ssh\config) and add an entry per server:
Host web1
HostName 203.0.113.10
User deploy
IdentityFile ~/.ssh/id_ed25519Now ssh web1 is enough. The same alias works with scp, rsync and editors that connect over SSH.
Step 5: stop retyping the passphrase
An SSH agent holds your unlocked key in memory for the session.
On macOS, store the passphrase in the Keychain:
ssh-add --apple-use-keychain ~/.ssh/id_ed25519On Linux desktops an agent usually runs already; otherwise start one and add the key:
eval "$(ssh-agent -s)"
ssh-add ~/.ssh/id_ed25519On Windows, enable the agent service once from an administrator PowerShell, then add the key from a normal one:
Get-Service ssh-agent | Set-Service -StartupType Automatic
Start-Service ssh-agent
ssh-add $env:USERPROFILE\.ssh\id_ed25519Adding a key to a server that already exists
If the server is already running and you can log in with a password, copy your key over. On macOS and Linux:
ssh-copy-id -i ~/.ssh/id_ed25519.pub [email protected]Windows has no ssh-copy-id, so pipe the key in PowerShell:
Get-Content $env:USERPROFILE\.ssh\id_ed25519.pub | ssh [email protected] "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"Lost access completely? Use the browser SSH console on the server page in the console, or reset the root password there, then add the key.
A note for PuTTY users
PuTTY uses its own key format, .ppk. You have two options:
- Generate the key in PuTTYgen: choose EdDSA with Ed25519, click Generate, set a passphrase, and save the private key as
.ppk. Copy the public key from the box at the top of the window, which is already in OpenSSH format, and add that to the console. - Or reuse a key made with
ssh-keygen: open PuTTYgen, use Conversions, Import key, selectid_ed25519, then save it as.ppk.
In PuTTY, load the .ppk under Connection, SSH, Auth, Credentials (in older versions, under Connection, SSH, Auth). Most Windows users today can skip PuTTY and use the built-in ssh command in PowerShell or Windows Terminal.
Troubleshooting
| Error | Likely cause | Fix |
|---|---|---|
Permission denied (publickey) | Wrong key, wrong user, or key not on server | Check the user name, use -i, confirm the key in authorized_keys |
UNPROTECTED PRIVATE KEY FILE | Private key readable by others | chmod 600 ~/.ssh/id_ed25519 |
Connection timed out | Firewall or wrong IP | Check the IP and that port 22 is allowed |
REMOTE HOST IDENTIFICATION HAS CHANGED | Server was rebuilt with the same IP | ssh-keygen -R 203.0.113.10, then reconnect |
For any other problem, run ssh -v [email protected] and read which keys are offered and why they are rejected. On the server, ~/.ssh should be 700 and authorized_keys should be 600, owned by the user you log in as.
Once you are in, measure the connection quality with ping and mtr, especially if the session feels sluggish, and revisit choosing a VPS location by latency if the numbers are high.
FAQ
Should I use ed25519 or RSA?
Use ed25519 unless a very old system cannot accept it. If you need RSA, use 4096 bits with ssh-keygen -t rsa -b 4096.
Can I use the same key for several servers?
Yes. The public key can go on as many servers as you like. Use separate keys per device, so you can revoke one laptop without touching the others.
Is a passphrase really necessary?
It is strongly recommended. Without one, anyone who copies the private key file gets access to every server that trusts it. An agent means you type it only once per session.
What if I lose my private key?
Create a new key, log in through the browser console or with the root password, add the new public key to authorized_keys, and remove the old one.
Deploy with your key
Add your public key in the Cloudj console, select it when you deploy, and your first login will be key-based. Browse locations on the cloud servers page and check live prices on the pricing page.