Supported key types
Use ed25519 unless something in your environment forbids it.
ssh-keygen -t ed25519 -C "you@example.com"
It has no parameters to get wrong, produces a public key short enough to read in one glance, and every OpenSSH release since 6.5 supports it. Reach for another algorithm only when you have a reason.
Accepted types
A public key is accepted only when its first field is one of these, spelled exactly this way:
| Type | Generate with | Notes |
|---|---|---|
ssh-ed25519 | ssh-keygen -t ed25519 | recommended |
ssh-rsa | ssh-keygen -t rsa -b 4096 | widest compatibility with old tooling, much larger keys |
ecdsa-sha2-nistp256 | ssh-keygen -t ecdsa -b 256 | NIST P-256 |
ecdsa-sha2-nistp384 | ssh-keygen -t ecdsa -b 384 | NIST P-384 |
ecdsa-sha2-nistp521 | ssh-keygen -t ecdsa -b 521 | NIST P-521 |
sk-ssh-ed25519@openssh.com | ssh-keygen -t ed25519-sk | hardware security key; needs OpenSSH 8.2 or later, and the token has to be plugged in to connect |
Anything else is refused when you add it, with INVALID_SSH_KEY.
Not accepted
| What you might paste | Why it fails |
|---|---|
ssh-dss (DSA) | not on the list; long deprecated and dropped by current OpenSSH |
sk-ecdsa-sha2-nistp256@openssh.com | the ECDSA security-key variant is not on the list — use ed25519-sk |
A certificate such as ssh-ed25519-cert-v01@openssh.com | Superheat takes plain public keys, not certificates |
A PuTTY .ppk file | not an OpenSSH public key; copy the OpenSSH text out of PuTTYgen instead |
Anything starting -----BEGIN | that is a private key — see Generate a key |
The format
One line, two fields, plus an optional comment:
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ8mQ2sT9vXbN1kR4pLwZ0aYcE7hJ6uD3fGgH5iKmNoP you@example.com
| Field | Required | What is checked |
|---|---|---|
| Type | yes | must match the accepted list exactly |
| Key material | yes | decoded as strict base64, and must not be too short to be a key |
| Comment | no | stored with the key line, and ignored when the fingerprint is computed |
A trailing newline is trimmed for you. A leading space or blank line is not — the console form checks the paste from its first character and rejects it as "That doesn't look like an OpenSSH public key", so start the paste at the key type. A line break inserted in the middle of the key material also breaks it: some editors and chat clients wrap long lines when you paste through them. Copy from the file with one of the commands in Generate a key.
Fingerprints
Superheat derives a SHA256 fingerprint from the key material and shows it under the key's name on the SSH Keys page:
SHA256:Pr6lxPUhwJ7+VHus18B6LLkVm4mFu0L9hn8eqgpOyag
This is the same fingerprint OpenSSH computes, so you can confirm locally which of your keys is in the account:
ssh-keygen -lf ~/.ssh/id_ed25519.pub
The fingerprint is also the identity of the key. Two entries on one account cannot carry the same key material under different names — the second attempt returns DUPLICATE_SSH_KEY. MD5 fingerprints, the older colon-separated hex format, are not used anywhere in the product.
Choosing between them
ed25519 | ssh-rsa | ecdsa | |
|---|---|---|---|
| Public key length | about 80 characters | about 720 characters at 4096 bits | 160 characters at P-256, 252 at P-521 |
| Choices you have to make | none | key size | curve |
| Supported since OpenSSH | 6.5 | 2.0 | 5.7 |
| Pick it when | always, by default | you must interoperate with old tooling that predates ed25519 | a policy requires a NIST curve |
If you use ssh-rsa, generate at least 3072 bits. Superheat does not reject shorter RSA keys, but short RSA keys are weak and modern clients increasingly refuse them.
Ready to use one? Add a key.