Ed25519 or RSA for SSH keys: what to generate today

Generate an Ed25519 key. Use RSA with 4096 bits only for a legacy system that cannot handle Ed25519. Protect the private key with a passphrase either way, and think about a hardware-backed key type if you want the key to stay off the laptop disk.

The short version of GitHub's advice

GitHub's guide to generating a key recommends Ed25519, using this command:

ssh-keygen -t ed25519 -C "your_email@example.com"

For legacy systems that do not support Ed25519, it says to use RSA with a 4096-bit key. That is the full decision tree for most people.

What the passphrase does

GitHub says to protect your private key with a passphrase, because anyone who obtains the key file could otherwise use it. Developers skip this because typing it is annoying. An agent fixes that, which is covered in the post on keeping SSH passphrases usable with an agent.

Hardware security keys

If you have a hardware security key, GitHub says to use the key type ed25519-sk, or ecdsa-sk if your key does not support Ed25519. The private key material then lives on the device, which changes what an attacker gets if they copy your home directory.

I cannot confirm from the page cited here how touch requirements or resident keys behave on each model, so check your key vendor's documentation before rolling this out to a team.

Old keys you may still have

Look in your .ssh folder. If you find old RSA keys with short lengths, or keys you do not recognise, list where each public key is registered and remove the ones you no longer use. A key that nobody remembers is a key nobody rotates.

A quick audit:

1. List the files in your .ssh directory.
2. For each public key, find where it is registered, such as your Git host or servers.
3. Remove registrations for keys you no longer use.
4. Generate a new Ed25519 key for anything still relying on an old one.
5. Confirm each remaining private key has a passphrase.

One key or many

Some people use one key per machine, some one per service. A per-machine key makes it simple to revoke a lost laptop: remove that key and everything else keeps working. That is the pattern I would start with, but it is a choice rather than a documented requirement.

Quick check

Sources

• Generating a new SSH key and adding it to the ssh-agent (GitHub Docs)

Last reviewed: 19 October 2026.