To generate an OPENSSH-RSA key for GitHub on Windows 10, use the native OpenSSH client included in recent updates. Run
ssh-keygen -t rsa -b 4096 -C "[email protected]" in PowerShell or Command Prompt to create the public and private keys. Then, add the private key to the SSH agent using
ssh-add and copy the public key content from the
.pub file to your GitHub account settings for authentication.
Verifying Your Environment
Before generating new keys, it is essential to verify that your Windows 10 installation includes the necessary OpenSSH tools. Microsoft has bundled OpenSSH client and server components with Windows 10 since version 1809 and Windows Server 2019. This means you likely do not need to install third-party software like PuTTY or Git Bash, although those remain valid alternatives if you prefer them.
Open PowerShell or the Command Prompt by searching for them in the Start menu. Type
ssh -V and press Enter. If the command returns a version number starting with OpenSSH, you are ready to proceed. If you receive an error stating that ssh is not recognized, you may need to enable the feature through Windows Settings under Apps > Optional Features, or download the OpenSSH binaries manually. For most users running updated versions of Windows 10, this step should succeed immediately without additional configuration.
It is also worth checking if you already have existing keys. Look in the directory
C:\Users\YourUsername\.ssh. If you see files named
id_rsa,
id_ed25519, or similar, you might already have keys configured. Generating a new key will not overwrite these unless you explicitly specify the same filename during generation. However, creating a distinct key pair for GitHub ensures better security isolation and makes it easier to revoke access later if needed.
Generating the RSA Key Pair
The core task involves invoking the
ssh-keygen utility with specific parameters to ensure compatibility with GitHub. GitHub supports RSA keys up to 4096 bits, which provides a strong balance between security and performance. While newer Ed25519 keys are often recommended for their speed and smaller size, RSA remains widely supported and is specifically requested in many legacy or strict compliance environments.
Execute the following command in your terminal:
ssh-keygen -t rsa -b 4096 -C "[email protected]"
Replace
[email protected] with the email address associated with your GitHub account. This comment field helps identify the key when managing multiple devices. After typing the command, press Enter. The system will prompt you to enter a file name to save the key. Pressing Enter accepts the default location (
C:\Users\YourUsername\.ssh\id_rsa). Choosing a custom name can help distinguish between different keys, such as
github_work or
github_personal.
Next, you will be asked to enter a passphrase. A passphrase adds an extra layer of security by encrypting the private key on disk. If you leave this empty, the key will be unencrypted, which is less secure but more convenient for automated scripts. For personal development, entering a strong passphrase is highly recommended. You will need to confirm the passphrase by typing it again. Once completed,
ssh-keygen generates two files: the private key (without extension) and the public key (with a
.pub extension).
Adding the Key to the SSH Agent
Windows does not automatically load SSH keys into memory after every reboot. To avoid typing your passphrase repeatedly, you must add the private key to the SSH agent service. This service manages loaded keys and handles authentication requests transparently.
First, ensure the SSH agent service is running. In PowerShell, run:
Get-Service -Name ssh-agent | Select-Object Status
If the status is Stopped, start it with:
Start-Service ssh-agent
Then, configure it to start automatically on boot by running:
Set-Service -Name ssh-agent -StartupType Automatic
Now, add your newly generated key to the agent. Replace the path below with the actual path to your private key if you chose a custom name:
ssh-add C:\Users\YourUsername\.ssh\id_rsa
You will be prompted for the passphrase you created earlier. Upon successful addition, the command returns silently or confirms the key identity. You can verify the loaded keys by running
ssh-add -l, which lists all currently loaded identities.
Uploading the Public Key to GitHub
With the key pair generated and the private key loaded in the agent, the final step is to register the public key with GitHub. Navigate to your GitHub account settings by clicking your profile picture in the top right corner and selecting Settings. From the left sidebar, choose SSH and GPG keys, then click New SSH key.
In the Title field, give your key a descriptive name, such as "Windows 10 Laptop". In the Key field, you need to paste the contents of your public key file. Open the file
id_rsa.pub located in your
.ssh directory using Notepad or any text editor. Copy the entire line, which starts with
ssh-rsa and ends with your email comment. Paste this into the Key field on GitHub. Click Add key to save.
GitHub may ask you to confirm your password or use two-factor authentication before adding the key. Once added, you can test the connection by running
ssh -T [email protected] in your terminal. If configured correctly, you will see a message welcoming you to GitHub and confirming that the authentication was successful.
For further assistance with related issues, you might find these articles helpful:
Longtime SSH Key to GitHub Stops Working and
Troubleshooting SSH Login Delayed on Debian.
Frequently Asked Questions
Why is my SSH key being rejected by GitHub?
Most rejections occur because the public key uploaded to GitHub does not match the private key stored on your machine. Ensure you copied the exact content of the
.pub file without adding extra spaces or newlines. Also, verify that you are connecting via SSH (
[email protected]) rather than HTTPS, as HTTPS uses username/password or token authentication instead of keys.
Can I use Ed25519 keys instead of RSA?
Yes, GitHub fully supports Ed25519 keys, which are generally faster and considered more secure than RSA for equivalent key lengths. You can generate one using
ssh-keygen -t ed25519 -C "[email protected]". Many developers prefer this method for modern workflows due to its efficiency and shorter key strings.
What should I do if I forget my SSH passphrase?
There is no way to recover a forgotten passphrase because it is used to encrypt the private key. You must delete the existing key pair from your
.ssh directory and generate a new one. Remember to remove the old public key from your GitHub account settings to prevent confusion or unauthorized access attempts using the old identifier.
How do I fix permission denied errors on Windows?
On Windows, permissions are usually managed differently than on Linux, but incorrect ownership can still cause issues. Ensure your
.ssh folder and key files are only accessible by your user account. Right-click the folder, go to Properties, and check the Security tab. If other users have write access, remove it to maintain security standards required by the SSH client.
Does SSH agent work across different terminals?
Yes, once the SSH agent is started and the key is added, it persists across different terminal sessions within the same user context. Whether you use PowerShell, Command Prompt, or Git Bash, they all interact with the same background agent service. This allows seamless switching between tools without needing to re-enter passphrases or reload keys.