How to generate an SSH key on Windows. Tested, start to finish.

ssh-keygen -t ed25519 -C "laptop-2026" -f "$HOME\.ssh\id_ed25519"

$pubKey = (Get-Content "$HOME\.ssh\id_ed25519.pub" | Out-String); ssh [email protected] "mkdir -p ~/.ssh && chmod 700 ~/.ssh && echo '$pubKey' >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"

ssh -i "$HOME\.ssh\id_ed25519" [email protected]

Host myvps
    HostName 203.0.113.10
    User root
    IdentityFile ~/.ssh/id_ed25519
    IdentitiesOnly yes

icacls "$HOME\.ssh\id_ed25519" /inheritance:r
icacls "$HOME\.ssh\id_ed25519" /grant:r "${env:USERNAME}:R"

Each step below explains what these commands do and what you should see, so you’re never pasting blind.

PS C:\Users\you> ssh -V
OpenSSH_for_Windows_9.5p2, LibreSSL 3.8.2
PS C:\Users\you> Get-Service ssh-agent | Select-Object Status, StartType

Status  StartType
------  ---------
Stopped  Disabled

If you see a version, skip to step 2. If PowerShell says ssh isn’t recognised, install it. OpenSSH has been an optional Windows feature since Windows 10 build 1809:

• Windows 11: Settings, System, Optional features, View features, then search for OpenSSH Client and add it.
• Or in PowerShell as administrator: Add-WindowsCapability -Online -Name OpenSSH.Client~~~~0.0.1.0

ssh-keygen -t ed25519 -C "laptop-2026"

It asks three things: where to save the key (press Enter for the default), then a passphrase, twice. Here’s what comes back:

PS C:\Users\you> ssh-keygen -t ed25519 -C "litekeep-test"
Generating public/private ed25519 key pair.
Your identification has been saved in C:\Users\you\.ssh\id_ed25519
Your public key has been saved in C:\Users\you\.ssh\id_ed25519.pub
The key fingerprint is:
SHA256:JKnwhfyuOT429Sv/HeX4e/KgruZKIptps4IqhTB3SAU litekeep-test
The key's randomart image is:
+--[ED25519 256]--+
|  Eo.            |
|  .. . .         |
| ...o + .        |
|o oo.+ o         |
|.+ .o . S     .  |
|. .  ..      +   |
| o  ..o..   o o  |
|o . BB.o. .. +...|
|+  =O* o+*+o+ o=.|
+----[SHA256]-----+

Why Ed25519?

It’s short, fast and strong, and it’s been the default since OpenSSH 9.5 in 2023. On our PC, plain ssh-keygen made an Ed25519 key too. We still type -t ed25519 so the command works the same on older builds. Only use RSA (-t rsa -b 4096) for an old system that rejects Ed25519.

Use a passphrase

The passphrase encrypts the private key file. If your laptop is stolen, the key is useless without it. Don’t leave it empty. Step 6 shows how to type it once per session instead of every time.

Mind the label

The text after -C is a comment saved inside the public key. Without it, OpenSSH fills in your user@host: your Windows username and your PC’s name. That label ends up on every server you add the key to. Most tutorials tell you to put your email there. Use something neutral that tells you which device it is.

$pubKey = (Get-Content "$HOME\.ssh\id_ed25519.pub" | Out-String); ssh [email protected] "mkdir -p ~/.ssh && chmod 700 ~/.ssh && echo '$pubKey' >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"

It reads your public key, logs in one last time with your password, creates the .ssh folder if needed, adds the key, and sets the permissions the server insists on: 700 for the folder, 600 for the file. In our test it finished silently, which is what success looks like.

• Deploying on LiteKeep? Paste the contents of id_ed25519.pub when you deploy the server and skip this step entirely. Your first login already uses the key.
• Different SSH port? Add -p 2222 after ssh. The builder above does it for you.
• Never send the file without .pub. That’s your private key.

ssh [email protected]

The first time, it shows the server’s fingerprint and asks if you trust it. Compare it with your server’s fingerprint if you have it, then type yes. It’s saved in known_hosts and won’t ask again.

Then it asks for your key’s passphrase, not the server password. That difference is how you know the key worked. If you saved the key under another name, point at it with -i:

ssh -i "$HOME\.ssh\id_ed25519" [email protected]

Host myvps
    HostName 203.0.113.10
    User user
    IdentityFile ~/.ssh/id_ed25519
    IdentitiesOnly yes

Now ssh myvps is the whole command. In our test, a config like this logged straight in. Add Port 2222 if you use a different port, and one Host block per server.

IdentitiesOnly yes tells SSH to offer only that key. Without it, a PC with many keys can hit the server’s limit on attempts before the right key gets its turn.

Open PowerShell as administrator once and run:

Get-Service ssh-agent | Set-Service -StartupType Automatic
Start-Service ssh-agent

Then, in a normal PowerShell window, add your key and type the passphrase one last time:

ssh-add "$HOME\.ssh\id_ed25519"

From now on, ssh myvps connects without asking. Automatic keeps the agent running after a restart; Manual would mean starting it yourself each time.

• OpenSSH key to PPK: open PuTTYgen, choose Conversions, Import key, pick id_ed25519, enter its passphrase, then Save private key.
• PPK to OpenSSH: Load the .ppk, then Conversions, Export OpenSSH key.
• The public key for the server is the box labelled Public key for pasting into OpenSSH authorized_keys file. Copy from there, not from the “Save public key” file, which uses a different, multi-line format the server won’t accept.
• Old PuTTY? New PPK files are version 3. Only PuTTY 0.74 and older need version 2.

A surprise from our test: making authorized_keys group-writable (664) did not break login, because OpenSSH allows it when the group contains only you. Many guides say any loose permission breaks it. Only world-writable did.

See which key SSH is offering

Add -v and look for these lines:

PS C:\Users\you> ssh -v -i .\other_key [email protected]
debug1: Authentications that can continue: publickey
debug1: Offering public key: .\other_key ED25519 SHA256:EMQ9pBYv… explicit
debug1: Authentications that can continue: publickey
debug1: No more authentication methods to try.
[email protected]: Permission denied (publickey).

“UNPROTECTED PRIVATE KEY FILE” on Windows

If other accounts can read your private key, OpenSSH refuses to use it. We gave Everyone read access to a copy of our key to see it happen:

Bad permissions. Try removing permissions for user: \Everyone (S-1-1-0) on file C:/Users/you/.ssh/id_ed25519.
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions for 'C:\Users\you\.ssh\id_ed25519' are too open.
It is required that your private key files are NOT accessible by others.
This private key will be ignored.
[email protected]: Permission denied (publickey).

The fix: remove inherited permissions and give only yourself read access. These two lines fixed it in our test (if the warning names an account, like Everyone, also run icacls "$HOME\.ssh\id_ed25519" /remove Everyone):

icacls "$HOME\.ssh\id_ed25519" /inheritance:r
icacls "$HOME\.ssh\id_ed25519" /grant:r "${env:USERNAME}:R"

Do it in the order our VPS security guide lays out: create your own sudo user, give it your key, test in a second window, and only then disable root and password logins. Its free generator writes the commands for your server.

• New laptop? Make a new key on it and add that one too. Don’t copy private keys between machines.
• Lost a device? Delete its line from ~/.ssh/authorized_keys on every server.
• Running Windows Server too? Admin accounts there use administrators_authorized_keys in C:\ProgramData\ssh, not the file in your user folder.

Need a server to try this on? A Lite bills by the hour, so a practice run costs cents. Deploy a Lite 2 with your new key pasted in, and your first login is already passwordless. Or run Windows itself on a Windows VPS.