How to add an SSH key on macOS

Nodea provides Linux administration and server services, and logging in with an SSH key is our daily practice when managing servers. This guide takes a macOS user from zero to a working key-based login — it covers macOS only. The equivalents for other systems are documented separately: SSH key on Linux and SSH key with PuTTY on Windows.

What is an SSH key and why add it on macOS?

An SSH key is a pair of files — a private key and a public key — that lets you log in to a server without typing a password. macOS generates both files with a single command in Terminal, without installing any extra program.

The difference between them is critical for security:

• The private key stays only with you, on the Mac. It proves your identity, so you never hand it to anyone.
• The public key goes to the server. It does not need protecting — on its own it grants no access until a matching private key is present.

Key-based login replaces password login: it is safer, because a key cannot be guessed like a password, and more convenient, because you do not type a password on every connection. On macOS the ssh-keygen tool is already built into the system — 0 extra installs. That sets the Mac apart from Windows, where generating a key pair needs a separate program such as PuTTYgen. Everything is in place, so you start right away.

Generate an SSH key in macOS Terminal

How do you generate an SSH key on macOS? Open Terminal, type the ssh-keygen command, and confirm with Enter — macOS creates the key pair in a few seconds. Here is the full step-by-step procedure.

1. Open Terminal. It is an app built into macOS — the fastest way is to open Spotlight with Cmd+Space, type “Terminal”, and press Enter.
2. Type the ssh-keygen command and press Enter to start generating the SSH key on your Mac.
3. The system asks where to save the key. The default path is /Users/(username)/.ssh/id_rsa — accept it with Enter.
4. The system asks for a passphrase, the password that protects the key. Type one, or leave it empty by pressing Enter.

While you type the passphrase, Terminal shows no characters at all — the cursor stays put as if nothing is happening. That is normal in macOS and across Unix; the characters are hidden on purpose, so keep typing and confirm with Enter.

After you confirm, Terminal prints a confirmation similar to this:

Generating public/private rsa key pair.
Your identification has been saved in /Users/john/.ssh/id_rsa
Your public key has been saved in /Users/john/.ssh/id_rsa.pub

These two lines mean success: the files id_rsa (private key) and id_rsa.pub (public key) now exist.

What is a passphrase and is it worth setting?

A passphrase is an extra password protecting your private key — the longer it is, the safer. It guards the key in case the id_rsa file falls into the wrong hands: without a passphrase a stolen private key grants access immediately, with one it does not.

A passphrase is not mandatory. Leaving the field empty (Enter) gives a fully passwordless login, handy for automation. If you do set one, store it somewhere safe, such as a password manager — a passphrase cannot be recovered, and without it the private key becomes useless.

Where does macOS save the private and public key?

macOS saves both keys in the /Users/(username)/.ssh/ directory — the private key in the file id_rsa and the public key in the file id_rsa.pub. The same directory is also written in short form as ~/.ssh/.

• id_rsa — the private key. Never share it and never lose it. It is the only file that proves your identity to the server.
• id_rsa.pub — the public key. This is the file you copy to the server; you recognize it by the .pub ending.

To display the public key ready to copy, run cat ~/.ssh/id_rsa.pub. Terminal prints a single long line starting with ssh-rsa — that text is exactly what goes on the server.

The .ssh directory is hidden because its name starts with a dot, so Finder does not show it by default. To reveal hidden files and open .ssh in Finder, use the shortcut Cmd+Shift+dot. Pressing it again hides them once more.

Add the public key to the server

How do you add an SSH key to a server? Copy the contents of id_rsa.pub into the ~/.ssh/authorized_keys file on the server — then the server recognizes your key and lets you log in without a password. You always copy the public key; the private one stays on the Mac. There are two methods.

1. Automatic method (easiest) — type ssh-copy-id user@server-address in Terminal. You enter the server password once, and the command appends your public key to authorized_keys on the server by itself.
2. Manual method — log in to the server (for example with ssh and a password), open or create ~/.ssh/authorized_keys, and paste the public-key contents you read earlier with cat. Save the file.

After adding the key, check the permissions on the server: the authorized_keys file should be chmod 600 and the .ssh directory chmod 700. The server treats overly broad permissions as a risk and rejects the key.

Nodea hosting and server clients add their public key through the client panel or by contacting support — you do not have to do it by hand on the server. It is enough to send us the contents of the id_rsa.pub file.

Test the key login and fix common problems

To check whether the SSH key works, connect with ssh user@server-address — if the server does not ask for a password, the key works. No password prompt is the signal that public-key login succeeded. The three most common problems and their fixes:

• The server still asks for a password — check that the public key actually landed in authorized_keys on the server. The usual cause is copying an incomplete id_rsa.pub line, or adding the key to a different user's account than the one you log in as.
• Permissions too open — the server rejects a private key that is too widely accessible. Fix it with chmod 600 ~/.ssh/id_rsa so the key is no longer readable by other users of the system.
• Permission denied (publickey) — you are logging in as the wrong user, or the public key was not added on the server. Check the username in the ssh command and the presence of the key in authorized_keys.

If you use a passphrase, macOS remembers it in the Keychain so it does not ask on every connection — you enter it once, and the system supplies it automatically on later logins. Once the key works, the next step is a regular SSH connection to an account on the server.