SSH keys on a Mac, explained plainly

Why use a key instead of a password?

An SSH key is a pair of files. The private key stays on your Mac and is never shared. The public key is a matching lock you can hand to anyone: GitHub, your router, your NAS. Whatever has your public key will let in whoever holds the private key.

What happens when you connect

1. You run ssh nas. The NAS finds your public key in its list of allowed keys.
2. It sends your Mac a random challenge.
3. Your Mac signs the challenge with the private key and sends back only the signature.
4. The NAS checks the signature against the public key. If it matches, you are in. The private key never leaves your Mac.

Why it is easier

• Nothing to type. Once the key is in the macOS Keychain, ssh and git push just work.
• No passwords to invent, remember or reuse across devices. One key can open many doors.
• Names in ~/.ssh/config turn ssh [email protected] into ssh router.

Why it is more secure

• Nothing secret crosses the network. A password is sent to the server every time, so a fake server, a leak or a keylogger can capture it. A signature is useless to anyone who sees it.
• It cannot be guessed. Attackers run bots that try common passwords against every router and NAS on the internet. An ed25519 key has so many possibilities that guessing it is not feasible.
• It can be revoked one device at a time. Delete one line on the server and that key stops working, with no password to change everywhere else.
• A stolen key file is still locked. The passphrase encrypts the private key on disk, and the Keychain unlocks it for you.
• Once keys work, you can switch password login off on the device, which closes the door on password guessing completely.

The one rule: guard the private key file (the one without .pub). Never send it, paste it or commit it to git.