--- title: "How to add an SSH key on macOS" description: "How to add an SSH key on macOS? Generate a key pair with ssh-keygen in Terminal, find id_rsa and id_rsa.pub, and add the public key to the server step by step." url: "https://nodea.io/en/docs/how-to-add-an-ssh-key-on-macos" lang: "en" updated: "2026-07-13" --- # How to add an SSH key on macOS > A step-by-step guide: how to generate an SSH key pair on macOS with ssh-keygen in Terminal, where the keys are saved, and how to add the public key to a server. Nodea provides Linux administration and server services, and logging in with an SSH key is our daily practice when managing servers. This guide takes a macOS user from zero to a working key-based login — it covers macOS only. The equivalents for other systems are documented separately: [SSH key on Linux](https://nodea.io/en/docs/how-to-add-ssh-key-linux) and [SSH key with PuTTY on Windows](https://nodea.io/en/docs/how-to-add-ssh-key-windows-putty). ## What is an SSH key and why add it on macOS? An SSH key is a pair of files — a private key and a public key — that lets you log in to a server without typing a password. macOS generates both files with a single command in Terminal, without installing any extra program. The difference between them is critical for security: - The **private key** stays only with you, on the Mac. It proves your identity, so you never hand it to anyone. - The **public key** goes to the server. It does not need protecting — on its own it grants no access until a matching private key is present. Key-based login replaces password login: it is safer, because a key cannot be guessed like a password, and more convenient, because you do not type a password on every connection. On macOS the **ssh-keygen** tool is already built into the system — 0 extra installs. That sets the Mac apart from Windows, where generating a key pair needs a separate program such as PuTTYgen. Everything is in place, so you start right away. ## Generate an SSH key in macOS Terminal How do you generate an SSH key on macOS? Open Terminal, type the **ssh-keygen** command, and confirm with Enter — macOS creates the key pair in a few seconds. Here is the full step-by-step procedure. 1. Open Terminal. It is an app built into macOS — the fastest way is to open Spotlight with **Cmd+Space**, type “Terminal”, and press Enter. 2. Type the **ssh-keygen** command and press Enter to start generating the SSH key on your Mac. 3. The system asks where to save the key. The default path is **/Users/(username)/.ssh/id\_rsa** — accept it with Enter. 4. The system asks for a passphrase, the password that protects the key. Type one, or leave it empty by pressing Enter. While you type the passphrase, Terminal shows no characters at all — the cursor stays put as if nothing is happening. That is normal in macOS and across Unix; the characters are hidden on purpose, so keep typing and confirm with Enter. After you confirm, Terminal prints a confirmation similar to this: *Generating public/private rsa key pair. Your identification has been saved in /Users/john/.ssh/id\_rsa Your public key has been saved in /Users/john/.ssh/id\_rsa.pub* These two lines mean success: the files id\_rsa (private key) and id\_rsa.pub (public key) now exist. ### What is a passphrase and is it worth setting? A passphrase is an extra password protecting your private key — the longer it is, the safer. It guards the key in case the id\_rsa file falls into the wrong hands: without a passphrase a stolen private key grants access immediately, with one it does not. A passphrase is not mandatory. Leaving the field empty (Enter) gives a fully passwordless login, handy for automation. If you do set one, store it somewhere safe, such as a password manager — a passphrase cannot be recovered, and without it the private key becomes useless. ## Where does macOS save the private and public key? macOS saves both keys in the **/Users/(username)/.ssh/** directory — the private key in the file **id\_rsa** and the public key in the file **id\_rsa.pub**. The same directory is also written in short form as ~/.ssh/. - **id\_rsa** — the private key. Never share it and never lose it. It is the only file that proves your identity to the server. - **id\_rsa.pub** — the public key. This is the file you copy to the server; you recognize it by the .pub ending. To display the public key ready to copy, run **cat ~/.ssh/id\_rsa.pub**. Terminal prints a single long line starting with ssh-rsa — that text is exactly what goes on the server. The .ssh directory is hidden because its name starts with a dot, so Finder does not show it by default. To reveal hidden files and open .ssh in Finder, use the shortcut **Cmd+Shift+dot**. Pressing it again hides them once more. ## Add the public key to the server How do you add an SSH key to a server? Copy the contents of id\_rsa.pub into the **~/.ssh/authorized\_keys** file on the server — then the server recognizes your key and lets you log in without a password. You always copy the public key; the private one stays on the Mac. There are two methods. 1. **Automatic method (easiest)** — type **ssh-copy-id user@server-address** in Terminal. You enter the server password once, and the command appends your public key to authorized\_keys on the server by itself. 2. **Manual method** — log in to the server (for example with ssh and a password), open or create ~/.ssh/authorized\_keys, and paste the public-key contents you read earlier with cat. Save the file. After adding the key, check the permissions on the server: the authorized\_keys file should be **chmod 600** and the .ssh directory **chmod 700**. The server treats overly broad permissions as a risk and rejects the key. Nodea hosting and server clients add their public key through the client panel or by contacting support — you do not have to do it by hand on the server. It is enough to send us the contents of the id\_rsa.pub file. ## Test the key login and fix common problems To check whether the SSH key works, connect with **ssh user@server-address** — if the server does not ask for a password, the key works. No password prompt is the signal that public-key login succeeded. The three most common problems and their fixes: - **The server still asks for a password** — check that the public key actually landed in authorized\_keys on the server. The usual cause is copying an incomplete id\_rsa.pub line, or adding the key to a different user's account than the one you log in as. - **Permissions too open** — the server rejects a private key that is too widely accessible. Fix it with **chmod 600 ~/.ssh/id\_rsa** so the key is no longer readable by other users of the system. - **Permission denied (publickey)** — you are logging in as the wrong user, or the public key was not added on the server. Check the username in the ssh command and the presence of the key in authorized\_keys. If you use a passphrase, macOS remembers it in the Keychain so it does not ask on every connection — you enter it once, and the system supplies it automatically on later logins. Once the key works, the next step is a regular [SSH connection to an account on the server](https://nodea.io/en/docs/how-to-add-ssh-key-linux). ### How do I generate an SSH key on a Mac? Open Terminal, type the ssh-keygen command, and press Enter. macOS creates a key pair — private and public — in the ~/.ssh/ directory within a few seconds. ### Where is the SSH key on macOS? The keys live in /Users/(username)/.ssh/. The private key is the file id\_rsa and the public key is id\_rsa.pub, ending in .pub. ### How do I add an SSH key to a server? Copy the contents of id\_rsa.pub into ~/.ssh/authorized\_keys on the server. The easiest way is a single command: ssh-copy-id user@server-address. ### Do I need to install a program for SSH keys on macOS? No. macOS has ssh-keygen built into Terminal — you install nothing extra. On Windows the same task needs a separate program, such as PuTTYgen. ### Which key do I copy to the server — private or public? Always the public one, the id\_rsa.pub file. The private key (id\_rsa) stays on your Mac and is never shared or copied to the server. ### Do I have to set a passphrase? No — you can leave the field empty by pressing Enter. A passphrase is an extra password that protects the private key in case the file is stolen. ## Related - [How to Add an SSH Key on Linux? Generating and Configuring Step by Step](https://nodea.io/en/docs/how-to-add-ssh-key-linux) - [How to Add an SSH Key with PuTTY on Windows?](https://nodea.io/en/docs/how-to-add-ssh-key-windows-putty) - [SSH](https://nodea.io/en/glossary/ssh) - [Server](https://nodea.io/en/glossary/server) - [FTP Account](https://nodea.io/en/docs/ftp-account) --- Languages: [pl](https://nodea.pl/pl/dokumentacja/jak-dodac-klucz-ssh-macos.md) Site index: [llms.txt](https://nodea.io/en/llms.txt)