Create an SSH key

An SSH key pair has two parts. The private key proves your identity and stays on your computer. The public key can be installed on servers that should accept that identity.

Create a dedicated Ed25519 key on your computer:

ssh-keygen -t ed25519 -f ~/.ssh/digitalocean_notes -C "digitalocean-notes"

Choose a strong passphrase when prompted. The command creates:

~/.ssh/digitalocean_notes
~/.ssh/digitalocean_notes.pub

The file ending in .pub is the public key. Print and copy only that file into the DigitalOcean SSH-key form:

cat ~/.ssh/digitalocean_notes.pub

Before uploading it, inspect its fingerprint:

ssh-keygen -lf ~/.ssh/digitalocean_notes.pub

DigitalOcean should show the same fingerprint after saving the key. The fingerprint is shorter and safer to compare than a long public-key line.

Never print the private key. Do not paste it into DigitalOcean, a chat, the server, or a Git repository. If the private file is readable by other local users, OpenSSH may refuse it. Restore the expected permissions with:

chmod 600 ~/.ssh/digitalocean_notes

Be careful when choosing the filename. ssh-keygen asks before overwriting an existing key, but replacing a key can remove your only access to servers that trust it.

Back up the private key in an encrypted password manager or another protected backup. Also keep a second administrator key or a documented recovery-console path for an important server. Losing the only private key does not reveal it to an attacker, but it can lock you out.

Your action is to add the public key to DigitalOcean, compare the displayed fingerprint, and label it with the computer and purpose. A name such as macbook-notes-admin-2026 is more useful later than my key.