ssh-keygen Command in Linux: Generate, Inspect, and Manage SSH Keys

Ed25519 keys are short, fast, and the default choice on current OpenSSH releases.

Run the command (empty passphrase for lab; use a real passphrase in production):

ssh-keygen -t ed25519 -f ~/.ssh/lab_ed25519 -N "" -C "lab ed25519 key"

Sample output:

Generating public/private ed25519 key pair.
Your identification has been saved in /root/.ssh/lab_ed25519
Your public key has been saved in /root/.ssh/lab_ed25519.pub
The key fingerprint is:
SHA256:K4diLvS+MLh+z7Sxn77b03RRlZw8VjfMeELAgAssa/4 lab ed25519 key
The key's randomart image is:
+--[ED25519 256]--+
|    .   ..o.o.*.O|
|   . o .   . o %o|
|    o . .     = .|
|   o   .     .   |
|  o     S     .  |
| ...   . . . .   |
|..o.+oo o o .    |
| ..*+E+oo. .     |
|o..o=*o*o..      |
+----[SHA256]-----+

List the fingerprint and confirm the comment:

ssh-keygen -l -f ~/.ssh/lab_ed25519

Sample output:

256 SHA256:K4diLvS+MLh+z7Sxn77b03RRlZw8VjfMeELAgAssa/4 lab ed25519 key (ED25519)

Copy the .pub line to the server's ~/.ssh/authorized_keys. Remove lab keys with rm ~/.ssh/lab_ed25519 ~/.ssh/lab_ed25519.pub.

Some older gear only accepts RSA. Use 4096 bits on modern systems.

Run the command:

ssh-keygen -t rsa -b 4096 -f ~/.ssh/lab_rsa -N "oldpass" -q -C "lab rsa"

Sample output (-q suppresses most lines):

Verify the key type and size:

ssh-keygen -l -f ~/.ssh/lab_rsa

Sample output:

4096 SHA256:… lab rsa (RSA)

Remove test keys when finished: rm ~/.ssh/lab_rsa ~/.ssh/lab_rsa.pub.

When you have the private key but lost the .pub file, -y recreates the public line.

Run the command:

ssh-keygen -y -f ~/.ssh/lab_ed25519

Sample output (truncated):

ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJOJVcLLJ4EFpwbSXBOdJ5Yy…

Append that single line to authorized_keys on the server you want to reach.

Rotate a passphrase without generating a new key — the public key on servers stays the same.

Run the command:

ssh-keygen -p -f ~/.ssh/lab_rsa -P "oldpass" -N "newpass"

Sample output:

Key has comment 'lab rsa'
Your identification has been saved with the new passphrase.

If you forgot the passphrase, you cannot recover it — generate a new key pair and replace the public key on every host.

Comments help you tell keys apart in ssh-add -l output. They do not affect authentication.

Run the command:

ssh-keygen -c -f ~/.ssh/lab_ed25519 -C "updated comment" -N ""

Sample output:

Old comment: lab ed25519 key
Comment 'updated comment' applied

Confirm:

ssh-keygen -l -f ~/.ssh/lab_ed25519

Sample output:

256 SHA256:K4diLvS+MLh+z7Sxn77b03RRlZw8VjfMeELAgAssa/4 updated comment (ED25519)

Separate keys per environment — production, staging, CI — by storing each pair under its own basename.

Run the command:

ssh-keygen -t ed25519 -f ./deploy_key -N "" -C "ci deploy"
ls -l deploy_key deploy_key.pub

Sample output:

Generating public/private ed25519 key pair.
…
-rw------- 1 root root  … deploy_key
-rw-r--r-- 1 root root  … deploy_key.pub

Use ssh -i ./deploy_key user@host or an IdentityFile line in ~/.ssh/config. Delete test files with rm deploy_key deploy_key.pub.

SSH refuses to connect when the server's host key changes. -R deletes the old entry from known_hosts.

Add a test line, then remove it:

echo "127.0.0.1 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFakeKeyForTestOnly" >> ~/.ssh/known_hosts
ssh-keygen -R 127.0.0.1 -f ~/.ssh/known_hosts

Sample output:

# Host 127.0.0.1 found: line 1
/root/.ssh/known_hosts updated.
Original contents retained as /root/.ssh/known_hosts.old

On the next connection, SSH prompts you to trust the new host key.

Running ssh-keygen alone walks through path, passphrase, and comment — the path most desktop users take once per machine.

Start the tool (press Enter at prompts to accept defaults in a lab):

ssh-keygen -t ed25519

Sample prompts:

Generating public/private ed25519 key pair.
Enter file in which to save the key (/root/.ssh/id_ed25519):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:

If ~/.ssh/id_ed25519 already exists, you get an overwrite warning — answer n unless you intend to replace the key. Back up old keys before replacing.

Hashing hides plain hostnames from anyone reading ~/.ssh/known_hosts on disk. OpenSSH still matches entries at connect time.

Run on a copy in a lab directory:

cp ~/.ssh/known_hosts /tmp/lab_known_hosts
ssh-keygen -H -f /tmp/lab_known_hosts
head -1 /tmp/lab_known_hosts

Sample output (first line becomes hashed):

|1|DnQfHwXX0E78Kqd9sM+jhKICLhM=|A7gki0vPIUajFlROxDljIxE6rGM= ssh-ed25519 AAAA…

A .old backup is created beside the file. Remove /tmp/lab_known_hosts* when done.