Create an SSH key with easySSH

SSH key authentication uses a pair of files. The private key stays on your Mac. The public key can be installed on each server account that should accept it. easySSH can create an Ed25519 pair and show the public part for copying.

Before you create a key

Check the Keys section first. You may already have a suitable key in ~/.ssh. Reusing a key or creating one per service is an operational choice. If the Mac is managed by an organisation, follow its key policy.

Choose a file name that identifies the key without containing a password or other secret. easySSH never overwrites an existing key file.

Create the pair

Open the easySSH manager.
Select the Keys section.
Choose the plus button.
Enter a file name, such as project-docs.
Add an optional comment that helps you recognise the key.
Enter a strong passphrase.
Enter the same passphrase again.
Choose Create.

easySSH calls the ssh-keygen tool supplied with macOS. The passphrase is sent to the tool through standard input, not placed in the command line. After creation, easySSH verifies that a key intended to be protected is actually encrypted.

The result consists of two files in ~/.ssh:

project-docs is the private key
project-docs.pub is the public key

The actual name follows the value you entered. The file without .pub must remain private. Do not send it by email, paste it into a support ticket or upload it to the server as a public key.

Install the public key on the server

Select the new key in easySSH.
Review its fingerprint and protection status.
In the Public key section, choose Copy to Clipboard.
Open the server provider's account settings or follow the administrator's documented process for adding an SSH public key.
Paste the complete public-key line and save it there.

On a conventional OpenSSH server, public keys are stored in the remote account's ~/.ssh/authorized_keys file. Hosting panels may provide a dedicated key field instead. Their menu names and activation steps vary, so use the provider's instructions.

Assign the key to a host

Return to the Hosts section.
Select the intended host.
Choose the new private key in the Key field.
Press Command-S.
Choose Connect and complete the first verified connection.

The connection is ready when the server accepts the key for the configured username. You can then choose Test. A key with a passphrase may need to be available through ssh-agent for the non-interactive test, even though the interactive connection can ask for the passphrase.

If it does not work

The two passphrases do not match: Re-enter both values. No key is created until they match.

The file name already exists: Choose a different name. easySSH does not replace existing private or public key files.

The server refuses the key: Confirm the username and that the full .pub line was added to the correct server account. Check whether the provider requires a separate activation step.

The key is reported as unprotected: Stop using it for new hosts until you have confirmed whether a passphrase was intended. Do not send the key for inspection.

Before deleting an old key, change and test every host that uses it. easySSH can warn about visible host entries, but scripts and included config files may also depend on that key.