SSH keys for GitHub
Updated July 31, 2026
An SSH key is a pair of files that replaces the password when you talk to GitHub: you hand the public half to the server and keep the private half to yourself.
Your account password has not worked for push since August 2021, GitHub stopped accepting it. If push asks for a password and then turns you away, the problem is not a typo. Two ways are left. Over HTTPS you paste a personal access token instead of a password: you create it in the account settings, it is shown once, and one day it expires. Over SSH you set up a key once, and after that neither push nor pull asks you anything.
Create the pair
$ ssh-keygen -t ed25519 -C "you@example.com"
Generating public/private ed25519 key pair.
Enter file in which to save the key (/home/user/.ssh/id_ed25519):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/user/.ssh/id_ed25519
Your public key has been saved in /home/user/.ssh/id_ed25519.pub-t ed25519 picks the key type, -C appends a label you will use to recognize the key in a list later. You can press Enter on all three questions: the default path is fine and a passphrase is optional.
You now have two files in ~/.ssh. id_ed25519 is the private key, and it never goes into a chat, a ticket or a repository. id_ed25519.pub is the public one, and handing it out is the whole point.
Give the public key to GitHub
$ cat ~/.ssh/id_ed25519.pub
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIR6FU/avIPTOFi3WmDc8cO9K0pHY/DActmHI+4BaY1H you@example.comCopy the whole line, from ssh-ed25519 to the email. On GitHub open Settings, then SSH and GPG keys, then the New SSH key button. In Title write which machine this is, so that a year from now you can tell the laptop from the work desktop. Leave Key type as Authentication Key and paste the line into the Key field.
One command checks the result:
$ ssh -T git@github.com
Hi username! You've successfully authenticated, but GitHub does not provide shell access.That is success. The part about shell access is not an error: GitHub gives nobody a shell, the key is there for git alone.
Switch a repository from HTTPS to SSH
The key is set up, but the project was cloned over HTTPS, so push still demands a token. One command changes the address:
$ git remote -v
origin https://github.com/username/my-project.git (fetch)
origin https://github.com/username/my-project.git (push)
$ git remote set-url origin git@github.com:username/my-project.gitMind the shape of it: an SSH address has a colon after the host name, not a slash. More about the link to the server is in git remote.
Common mistakes
$ git push
git@github.com: Permission denied (publickey).
fatal: Could not read from remote repository.The server accepted none of the keys offered to it. Check in order: run ssh -T git@github.com and read what it says; make sure what you pasted on GitHub is the .pub file and not the private key, and that it went in whole, without line breaks; make sure the file sits in ~/.ssh under the name ssh expects.
If you gave the key a passphrase, you will be asked for it on every operation. The agent keeps the decrypted key in memory:
$ eval "$(ssh-agent -s)"
Agent pid 34792
$ ssh-add ~/.ssh/id_ed25519
Identity added: /home/user/.ssh/id_ed25519 (you@example.com)One more trap is file permissions. SSH refuses to use a private key that anyone can read: chmod 700 ~/.ssh and chmod 600 ~/.ssh/id_ed25519 put things back in order.