Passwords feel fine until they aren't. They get brute-forced. They get leaked in breaches. You type them dozens of times a day on slow connections. And the moment you start managing more than one or two servers, the mental overhead of keeping strong, unique passwords for each one becomes genuinely painful. SSH keys solve all of this at once — and on Windows, they're easier to set up than most people expect.

This guide covers everything: what SSH keys actually are, why they're safer than passwords, how to generate them using Windows' built-in tools (no extra software needed), and how to copy them to your server so you never type a password again. If you already use MobaXterm for your SSH connections, there's a dedicated section for you too.

What Are SSH Keys? (The Simple Version)

An SSH key is a pair of files that work together like a physical lock and key:

When you connect, your computer proves it holds the private key that matches the public key on the server — without ever sending the private key over the network. If the two match, you're in. No password exchanged, nothing for an attacker to intercept.

Why SSH Keys Are Better Than Passwords

It's not even close. Here's the practical difference:

Watch: SSH Key Setup Step by Step

Before diving into the commands, this video walks through the entire process visually — from generating your key pair to connecting to a server without a password for the first time.

1 Generate Your SSH Key on Windows

Windows 10 and 11 ship with OpenSSH built in, which means you already have everything you need. No downloads, no extra software.

Open PowerShell

Press Windows key + X and select Terminal or Windows PowerShell. You don't need admin rights for key generation.

Run ssh-keygen

Type this command and press Enter:

ssh-keygen -t ed25519 -C "your-email@example.com"

The -C flag adds a comment to identify the key — use your email or a description like "work-laptop". It doesn't affect security, just helps you recognise the key later.

Choose where to save it

You'll see:

Enter file in which to save the key (C:\Users\YourName\.ssh\id_ed25519):

Press Enter to accept the default. Your keys will be saved to C:\Users\YourName\.ssh\ — that's the standard location all SSH tools expect.

Set a passphrase

Enter passphrase (empty for no passphrase):

Type a passphrase and press Enter, then confirm it. Use at least 12 characters — something memorable but not guessable. This passphrase encrypts your private key on disk, so even if someone steals your laptop, they still can't use your key without it.

Verify the result

dir $env:USERPROFILE\.ssh\

You should see two files:

• id_ed25519 — your private key. Guard this carefully.
• id_ed25519.pub — your public key. This is what you'll copy to servers.

Generating keys with MobaXterm

If you prefer a graphical interface and already have MobaXterm installed, it has a built-in key generator. Go to Tools → MobaKeyGen, select Ed25519, click Generate, move your mouse to create randomness, set a passphrase, and save the private key. Copy the public key text from the top box — that's what goes on your server.

2 Copy Your Public Key to the Server

Generating keys is the easy part. This step puts your public key on the server so it recognises you on login.

The one-liner method (quickest)

Windows doesn't have the ssh-copy-id command that Linux users know, but this PowerShell command does the exact same thing:

type $env:USERPROFILE\.ssh\id_ed25519.pub | ssh username@your-server.com "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"

Replace username with your server login name and your-server.com with your server's IP address or hostname. You'll be prompted for your password this one last time — after this, you won't need it again.

The manual method (most transparent)

If the one-liner doesn't work (some servers restrict pipe-based commands), do it manually:

1. Display your public key: type $env:USERPROFILE\.ssh\id_ed25519.pub
2. Copy the entire output — it starts with ssh-ed25519 and ends with your comment
3. SSH into your server with your password: ssh username@your-server.com
4. On the server, create the .ssh directory if it doesn't exist:

   mkdir -p ~/.ssh && chmod 700 ~/.ssh

5. Paste your public key into authorized_keys:

   echo "paste-your-public-key-here" >> ~/.ssh/authorized_keys
   chmod 600 ~/.ssh/authorized_keys

6. Type exit to disconnect

3 Test Your Connection

Now disconnect and reconnect using key authentication:

ssh username@your-server.com

If you set a passphrase, you'll be prompted for it — note this is your key passphrase, not your server password. If no passphrase, you'll land straight at the server prompt. Either way, you should connect without typing a server password.

If something goes wrong, add -v to see exactly what's happening:

ssh -v username@your-server.com

The verbose output will tell you which keys were tried, whether the server accepted them, and where the handshake failed. Read it top-to-bottom — the relevant error is usually near the bottom.

4 Set Up the SSH Agent (Type Your Passphrase Once)

With a passphrase on your key, you'll be asked for it every time you SSH. The SSH agent solves this — it holds your decrypted key in memory for the duration of your session, so you type the passphrase once and then connect freely.

Run these commands in PowerShell (as Administrator):

# Set agent to start automatically with Windows
Get-Service ssh-agent | Set-Service -StartupType Automatic
Start-Service ssh-agent

# Add your key to the agent (prompts for passphrase once)
ssh-add "$env:USERPROFILE\.ssh\id_ed25519"

After running ssh-add, enter your passphrase when prompted. From that point on, every SSH connection in the same session uses the agent — no passphrase required.

Bonus: Create an SSH Config File for One-Word Connections

Instead of typing ssh username@192.168.1.100 -i C:\Users\YourName\.ssh\id_ed25519 every time, an SSH config file lets you type just ssh myserver.

Create or open the config file:

notepad $env:USERPROFILE\.ssh\config

Add an entry for each server:

Host myserver
    HostName 192.168.1.100
    User username
    IdentityFile C:\Users\YourName\.ssh\id_ed25519
    Port 22

Save the file with no extension (just config, not config.txt). Now ssh myserver connects with all the right settings. You can add as many Host blocks as you need.

For the full Microsoft documentation on Windows OpenSSH key management, see the Microsoft Learn OpenSSH key management guide. For platform-specific setups like GitHub, GitHub's SSH key guide covers their particular requirements in detail.

Common Errors and How to Fix Them

$key = "$env:USERPROFILE\.ssh\id_ed25519"
icacls $key /inheritance:r
icacls $key /grant:r "$($env:USERNAME):(F)"
icacls $key /grant:r "NT AUTHORITY\SYSTEM:(F)"

SSH Key Best Practices in 60 Seconds

• Always use a passphrase. It's your last line of defence if a device is stolen.
• Use Ed25519, not RSA. It's faster, shorter, and equally secure for everything modern.
• One key per device. Generate a separate key pair on each machine — laptop, desktop, work VM. If one device is lost, you revoke just that key.
• Never put your private key in cloud storage. Dropbox, Google Drive, email — all off-limits. Keys stay local.
• Rotate keys once a year. Generate a new pair, add the new public key to your servers, test it, then remove the old one.
• Back up your private key to an encrypted drive. If you lose it, you'll need to regenerate and re-authorise on every server you use.

Once SSH keys are in place, logging into remote servers stops feeling like a chore. You'll click into a downloaded terminal tool, type your passphrase once at the start of the day, and then hop between servers freely for the rest of the session. If you haven't set up MobaXterm yet — the terminal that makes all of this even smoother with its built-in SFTP panel and session manager — the MobaXterm getting started guide is the natural next read.