Resident or non resident FIDO SSH keys: which to use?

Use a non resident key by default, with the handle file on your laptop and the secret on the token. Choose a resident key only if you need to log in from many machines without carrying a file, and set a PIN on the token first, since a stolen token then carries more.

The difference in one paragraph

A FIDO SSH key has two parts: a key handle and a private key that never leaves the authenticator. With a normal key, the handle sits in a file in ~/.ssh. With the -O resident option, the handle is stored on the authenticator itself. The OpenSSH manual says that makes the key easier to use across computers.

Creating a resident key

ssh-keygen -t ed25519-sk -O resident -C "work key"

The manual says resident keys typically need a PIN set on the authenticator before generation. You can load them into an agent with ssh-add, and download them onto a new machine with the -K option of ssh-keygen.

The trade off

Resident

• Convenient on a fresh laptop or a shared bench machine.
• Fewer files to lose or forget to back up.
• Higher risk if the token is stolen, because both parts are on one device. The manual states this directly.

Non resident

• The handle file lives on your laptop. A thief needs the token and the file.
• You must copy the handle file to each machine you use, or create a key per machine.
• Losing the laptop does not lose the key, because the secret never lived there.

A quick decision guide

1. One main laptop, occasional use elsewhere: non resident, one key per device, two tokens registered.
2. Frequent hot desking or loaner machines: resident, with a PIN, and a policy to remove the key from servers if the token goes missing.
3. Shared or high risk environments: add verify-required if your token supports it, so each use needs the PIN as well as a touch. The manual says PIN is currently the only supported method and not all tokens support it.

Things to plan for

• Lost token. Remove its public key from every server and Git host immediately. Keep a written list of where each key is registered.
• Spare token. Register a second one at setup time, not after the first goes missing.
• Client version. OpenSSH 8.2 or later is needed on the machine you sign in from.

For the basics of how these keys work, start with SSH security keys explained. If a token is lost, follow the lost device checklist.

Quick check

Sources

• ssh-keygen manual, OpenBSD
• Generating a new SSH key and adding it to the ssh-agent, GitHub Docs

Last reviewed: 19 October 2026.