SSH keys on macOS, done properly: ed25519, the agent, and your Keychain

Most SSH key guides were written a decade ago and it shows. Here’s the short, current version for macOS.

Generate the right key

Use ed25519 — smaller, faster and stronger than the old RSA default:

ssh-keygen -t ed25519 -C "you@example.com"

Accept the default location (~/.ssh/id_ed25519) and set a passphrase. A key file without a passphrase is a plaintext credential on disk.

Let the Keychain remember the passphrase

macOS can store the passphrase in your login Keychain, so you type it once, ever:

ssh-add --apple-use-keychain ~/.ssh/id_ed25519

And in ~/.ssh/config:

Host *
  AddKeysToAgent yes
  UseKeychain yes

From now on the agent loads your key automatically — no passphrase prompts, no unencrypted keys.

Copy the public key to your server

ssh-copy-id user@your-server

Then disable password login on the server (PasswordAuthentication no in sshd_config) — the single biggest SSH hardening win.

Or skip the config files

Sshly does all of the above with a UI: import or generate keys, store passphrases in the Keychain automatically, and pick the right key per connection. The free tier covers 3 connections — plenty to try it.

Download Sshly →