---
title: "Generate an SSH key pair on your computer"
description: "Make an SSH key pair with ssh-keygen, keep the private key on your computer, and get the public key ready to add to TIR."
content_type: "how-to"
product: "ssh-keys"
platform: "TIR"
url: "/tir/ssh-keys/how-to/generate-an-ssh-key-pair-on-your-computer/"
topic: ["ssh-keys"]
---

# Generate an SSH key pair on your computer

An SSH key is a pair of files. You make the pair on your own computer, keep the private key
there, and add only the public key to TIR.
[How SSH keys work](/tir/ssh-keys/concepts/how-ssh-keys-work/) explains why.

## Generate the pair

Run this in a terminal. The command is the same on macOS, Linux, and Windows PowerShell:

```bash
ssh-keygen -t ed25519 -C "<your comment>"
```

`<your comment>` is a label that helps you tell the key apart, such as your email address. Use
`ed25519`: it is more secure and faster than the older RSA type, and both types work in TIR. When
`ssh-keygen` asks for a passphrase, set one; it protects the private key if the file is ever
copied.

The command makes two files:

| File                    | What it is  | What to do                               |
| ----------------------- | ----------- | ---------------------------------------- |
| `~/.ssh/id_ed25519`     | Private key | Keep it on your computer, private to you |
| `~/.ssh/id_ed25519.pub` | Public key  | Add this one to TIR                      |

## Print the public key

```bash
cat ~/.ssh/id_ed25519.pub
```

The output starts with `ssh-ed25519`, or `ssh-rsa` for an RSA key, then a long key, then your
comment. Copy the whole line.

The public key is ready to [add to TIR](/tir/ssh-keys/how-to/add-an-ssh-key/).