Create an SSH key

An SSH key pair has two halves. The private key stays on your computer and proves you are you. The public key goes on every server that should let you in. You can hand the public half to anyone. The private half never leaves your machine.

I create a separate key for each provider or project. If one key ever leaks, I know exactly what it can open.

Generate the key

Create an Ed25519 key with a name that says what it’s for:

ssh-keygen -t ed25519 -f ~/.ssh/digitalocean_notes -C "digitalocean-notes"

Ed25519 is the modern default: short keys, fast, and supported everywhere you’ll need it. Pick a strong passphrase when asked. It protects the private key if someone copies the file.

You get two files:

~/.ssh/digitalocean_notes
~/.ssh/digitalocean_notes.pub

The one ending in .pub is the public key. That’s the only one you’ll ever paste anywhere. Print it and copy the whole line into the DigitalOcean SSH key form:

cat ~/.ssh/digitalocean_notes.pub

Check the fingerprint

Before uploading, look at the key’s fingerprint:

ssh-keygen -lf ~/.ssh/digitalocean_notes.pub

You get something like 256 SHA256:Xk3v...Qh8 digitalocean-notes (ED25519). After you save the key, DigitalOcean shows a fingerprint too. They must match. A fingerprint is short enough to compare by eye, which a 70-character key line is not.

Protect the private key

Never cat the private key. Don’t paste it into DigitalOcean, a chat, the server or a Git repository. If OpenSSH finds the file readable by other users on your computer, it refuses to use it and prints UNPROTECTED PRIVATE KEY FILE!. Fix that with:

chmod 600 ~/.ssh/digitalocean_notes

Be careful with the filename you pass to -f. ssh-keygen asks before overwriting, but if you say yes to the wrong file you lose the key that other servers already trust. That can be your only way in.

Back the private key up in a password manager or another encrypted place. For a server that matters, keep a second admin key or a documented recovery console path too. Losing your only private key doesn’t give it to an attacker, but it does lock you out.

Now add the public key to DigitalOcean, compare the fingerprint, and give it a name that will still make sense in a year. macbook-notes-admin-2026 beats my key.