Skip to content

Key Management

Jump to bottom
Mehdi edited this page Sep 2, 2026 · 6 revisions

Key Management

SSH Pilot helps you generate SSH keys, deploy them to servers, and manage which keys a connection uses -- all without leaving the app.

Copy key to server dialog

What is an SSH Key?

An SSH key is a pair of cryptographic files that prove your identity to a server. Using keys is more secure and more convenient than passwords -- once a key is deployed, you can log in without typing a password every time.

Copying a Key to a Server (ssh-copy-id)

The easiest way to enable passwordless login is to copy your public key to the server.

Step 1 -- Open the dialog

  • Right-click a server in the sidebar and select Copy Key to Server
  • Or press Ctrl+Shift+K (Cmd+Shift+K on macOS)

The window title is Copy key to Server.

Step 2 -- Choose a key

Pick one of:

  • Copy existing key -- Choose a key from the Select key dropdown (discovered under ~/.ssh), or pick the trailing Browse for a key file… item to select another file
  • Generate new key -- Create a new key pair, then deploy it in the same flow

Step 3 -- Optional options

  • Encrypt with passphrase -- Available when generating a new key. If enabled, OpenSSH prompts for the passphrase securely after generation starts (via the app’s protected dialog)
  • Force key transfer -- Overwrite / force install on the server when a conflicting key situation would otherwise block the copy (on by default)

Step 4 -- Deploy

Click OK. SSH Pilot will:

  1. Generate a key first if you chose that mode
  2. Connect to the server
  3. Install your public key into the remote authorized_keys file

You may be prompted for the server password one last time. After this, reconnect -- you should no longer need that password for key-based login.

Generating a New SSH Key

You can generate a key from the same Copy key to Server dialog:

  1. Select Generate new key
  2. Set the Key file name (defaults to id_ed25519 or id_rsa based on type)
  3. Choose a Key type:
    • ed25519 (default, recommended) -- Fast, secure, widely supported
    • rsa -- Generated at 3072 bits for compatibility with older systems
  4. Optionally enable Encrypt with passphrase
  5. Click OK to generate and copy in one step

ECDSA is not offered in this generator. Prefer ed25519 unless you need RSA for an older server.

The new key pair is written under your SSH directory (normally ~/.ssh). The public key (.pub) is what gets installed on the server.

Managing Keys on a Connection

In Edit Connection → Authentication:

  • Switch between Key-based and Password authentication
  • Add one or more identity files (and optional certificates)
  • Only use the selected key(s) -- writes IdentitiesOnly yes
  • Add keys to agent -- maps to OpenSSH AddKeysToAgent (Default, Yes, No, Ask, Confirm)

Under Agent and hardware keys you can also set:

  • IdentityAgent -- which agent socket to use
  • PKCS#11 provider -- path to a smartcard / YubiKey library
  • FIDO security key provider -- path for FIDO/U2F providers

PKCS#11 is an optional provider path on a key-based connection -- it is not a separate top-level “authentication method” next to Password.

Managing Remote authorized_keys

To inspect or edit keys already installed on a server:

  1. Right-click the connection in the sidebar
  2. Select Manage authorized_keys…

For the full editor (local and remote), options, and how it differs from Copy Key to Server, see Authorized Keys.

To remove outdated server host keys after a rebuild, see Known Hosts.

SSH Agent Integration

When Add keys to agent is set to load keys on first use:

  • The key can be loaded into ssh-agent when needed
  • You only enter the passphrase when the agent requires it (often once per session)

You can also pick keys that are already In agent from the key chooser described above.

Using Hardware Security Keys

SSH Pilot supports PKCS#11 providers (for example YubiKey) and FIDO security key providers.

  1. Edit the connection
  2. Stay on Key-based authentication
  3. Under Agent and hardware keys, set PKCS#11 provider (and/or FIDO security key provider)
  4. Browse to the library path if needed (example on many Linux systems: /usr/lib/x86_64-linux-gnu/libykcs11.so)
  5. Save the connection

Exact library paths depend on your OS and the vendor package you installed.

Next Steps

Clone this wiki locally