SSH and authentication

In plain English

HTTPS and SSH are two ways your computer proves who you are when it talks to a service such as GitHub. With HTTPS you type a username and password or a token each time, while SSH uses a pair of keys: a private key that stays on your machine and a public key you upload to GitHub. A passphrase is an optional password that protects your private key if your computer is ever stolen. A token is a secret used as a password for programs, and it must never be committed into a repository.

Step by step

1. 1Generate a key pair with ssh-keygen using the ed25519 algorithm.
2. 2Protect your private key with a passphrase and add it to the SSH agent.
3. 3Copy the public key and paste it into your GitHub account.
4. 4Test the connection with ssh -T and switch your remote to the SSH URL.

ssh-keygen -t ed25519 -C "ada@example.com"
ssh-add ~/.ssh/id_ed25519
cat ~/.ssh/id_ed25519.pub
ssh -T git@github.com
git remote set-url origin git@github.com:ada/my-project.git

Common mistakes

• Uploading the private key to GitHub instead of the public key.
• Committing a personal access token or password into the repository.
• Reusing the same key everywhere, so one stolen key opens every account.
• Choosing no passphrase and leaving the private key unprotected on disk.