SSH Key Management on macOS: The Complete Guide

SSH keys are the standard way to authenticate with remote servers. If you're still typing passwords every time you connect, you're doing it wrong — and you're less secure. Here's everything you need to know about SSH key management on macOS.

Generating Your First SSH Key

Open Terminal and run:

ssh-keygen -t ed25519 -C "your@email.com"

Ed25519 is the modern standard — it's faster, more secure, and produces shorter keys than RSA. You'll be prompted for a file location (default is ~/.ssh/id_ed25519) and a passphrase.

Always set a passphrase. If your private key is ever compromised, the passphrase is your last line of defense.

Adding Your Key to ssh-agent

macOS has a built-in SSH agent that can store your passphrase in Keychain:

ssh-add --apple-use-keychain ~/.ssh/id_ed25519

This means you type your passphrase once, and macOS remembers it. Add this to your ~/.ssh/config to make it persist across reboots:

Host *
  AddKeysToAgent yes
  UseKeychain yes
  IdentityFile ~/.ssh/id_ed25519

Managing Multiple Keys

Most developers end up with multiple keys — one for GitHub, one for work servers, one for personal projects. The SSH config file is how you keep them organized:

Host github.com
  IdentityFile ~/.ssh/github_ed25519

Host staging
  HostName 10.0.1.50
  User deploy
  IdentityFile ~/.ssh/work_ed25519

Host production
  HostName prod.example.com
  User deploy
  IdentityFile ~/.ssh/work_ed25519
  Port 2222

Now you can just type ssh staging or ssh production instead of remembering IPs and usernames.

Copying Your Public Key to a Server

The quickest way:

ssh-copy-id -i ~/.ssh/id_ed25519.pub user@server

If ssh-copy-id isn't available, you can do it manually:

cat ~/.ssh/id_ed25519.pub | ssh user@server "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"

Best Practices

• Use Ed25519 over RSA. It's the current best practice.
• One key per context. Separate keys for work, personal, and CI/CD.
• Always use a passphrase. Let ssh-agent handle the convenience.
• Audit regularly. Check ~/.ssh/authorized_keys on your servers for old keys that should be removed.
• Set proper permissions: chmod 700 ~/.ssh and chmod 600 ~/.ssh/*.

Using a GUI for SSH Key Management

If you prefer a visual approach, tools like Pluto Door let you manage SSH keys, connections, and credentials through a native macOS interface — with everything stored securely in Keychain. No command line required for day-to-day management.