---
title: "How SSH keys work"
description: "Why TIR uses SSH key pairs instead of passwords, which half stays with you, and how to keep your keys safe."
content_type: "concept"
product: "ssh-keys"
platform: "TIR"
url: "/tir/ssh-keys/concepts/how-ssh-keys-work/"
topic: ["ssh-keys"]
---

# How SSH keys work

SSH keys are the recommended way to reach your instances and training clusters in TIR. A key is
far harder to guess than a password, and signing in with it keeps passwords off the network.

## The key pair

An SSH key is a pair of keys that belong together.

| Key         | Where it lives                              | What it does                        |
| ----------- | ------------------------------------------- | ----------------------------------- |
| Private key | On your computer, kept to yourself          | Proves who you are when you connect |
| Public key  | Added to TIR and attached to your resources | Lets the resource check who you are |

When you connect, the resource checks your private key against the public key it holds. If they
match, you are signed in, with no password. Keep the private key on your computer; only the public key
goes to TIR.

## Where keys live in TIR

- Your keys belong to you, so the same list shows in every project.
- A key you have attached to an instance, a virtual machine, or a training cluster counts as in
  use. Take it off those resources before you delete it.
- When you create a key in the browser, its private half stays with you alone; TIR keeps only the public key. See
  [Create a key in the browser](/tir/ssh-keys/how-to/create-an-ssh-key-in-the-browser/).

## Keep keys safe

- Use `ed25519` or RSA 4096. Both are stronger than older key types. Set a passphrase on the
  private key.
- Run `chmod 600 ~/.ssh/id_ed25519` on the private key. For a key made in the browser, run
  `chmod 600` on the downloaded file before first use. Keep private keys out of cloud storage,
  shared drives, and version control.
- Give each key a name that says which computer it is for. Replace your keys with new ones from
  time to time, and delete old or unused keys from TIR.

To put this into practice, see
[Generate a key pair on your computer](/tir/ssh-keys/how-to/generate-an-ssh-key-pair-on-your-computer/)
and [Add an SSH key](/tir/ssh-keys/how-to/add-an-ssh-key/).