Blog

Git SSH Keys for GitHub, GitLab, and Bitbucket on Windows

Prev in Git Git SSH Keys for GitHub, GitLab, and Bitbucket on Linux

Blog

Git SSH Windows Version Control Security Developer Tools

Git SSH Keys for GitHub, GitLab, and Bitbucket on Windows

Mohammad Abu Mattar Published: 22 Oct, 2022 Updated: 07 Jun, 2026 06 Mins read

Introduction

By default, Git talks to remotes over HTTPS, so it asks for your username and password on every git pull or git push. SSH fixes that. GitHub, GitLab, and Bitbucket all let Git authenticate over SSH with public-key encryption instead. Set it up once and you stop typing credentials for every Git command.

Info

An SSH key is a pair of files: a private key that never leaves your machine, and a public key you upload to each service. Authentication works by proving you hold the private key. No password travels over the network.

Make sure Git is installed

Before you start, check whether Git is already on your machine. Run this in Windows Terminal (or PowerShell):

1
git --version

If you get a version number back, you’re set skip to Generate SSH keys. If the command isn’t found, install Git using whichever method you prefer.

Download the latest Git for Windows from the official site.
Run the installer. The defaults are sensible clicking Next through each screen is fine for most setups, including the editor, line-ending, and terminal choices.
Click Install, then Finish.
Open a new terminal and confirm it worked:

1
git --version

1
choco install git -y

Then confirm the install:

1
git --version

1
winget install --id Git.Git -e

Then confirm the install:

1
git --version

Note

After installing Git, set your global name and email every commit you make is stamped with them:

1
git config --global user.name 'USERNAME'
2
git config --global user.email '[email protected]'

Generate SSH keys

Open Windows Terminal and generate a new key pair, replacing [email protected] with your email address. Use Ed25519 it’s what GitHub, GitLab, and Bitbucket recommend today. Reach for RSA only on an older system or server that doesn’t support Ed25519.

Ed25519 (recommended)
RSA (legacy)

1
ssh-keygen -t ed25519 -C "[email protected]"

This creates .ssh\id_ed25519 (private) and .ssh\id_ed25519.pub (public) in your user folder. Ed25519 keys are small and fast, with security on par with a 4096-bit RSA key.

1
ssh-keygen -t rsa -b 4096 -C "[email protected]"

This creates .ssh\id_rsa (private) and .ssh\id_rsa.pub (public). Use the older RSA type only if you need to talk to a legacy system or server that doesn’t support Ed25519.

After running the command, complete the prompts:

Choose where to save the private key. Press Enter to accept the default location (C:\Users\you\.ssh\id_ed25519, or id_rsa for an RSA key):

1
Enter file in which to save the key (/c/Users/you/.ssh/id_ed25519): [Press Enter]

If a key already exists, you’ll be asked whether to overwrite it. Type y and press Enter:

1
Overwrite (y/n)?

Enter and re-enter a passphrase (think of it as a password for the key):

1
Enter passphrase (empty for no passphrase): [Type a passphrase]
2
Enter same passphrase again: [Type passphrase again]

Tip

A passphrase encrypts your private key on disk, so a stolen key file is useless without it. On Windows you can have the OpenSSH Authentication Agent remember it for you (see the FAQ below) so you only type it once.

The whole interaction should look like this:

Ed25519 (recommended)
RSA (legacy)

1
Generating public/private ed25519 key pair.
2
Enter file in which to save the key (/c/Users/you/.ssh/id_ed25519):
3
Created directory '/c/Users/you/.ssh'.
4
Enter passphrase (empty for no passphrase):
5
Enter same passphrase again:
6
Your identification has been saved in /c/Users/you/.ssh/id_ed25519.
7
Your public key has been saved in /c/Users/you/.ssh/id_ed25519.pub.
8
The key fingerprint is:
9
SHA256:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx YOUR_EMAIL@EXAMPLE.COM

1
Generating public/private rsa key pair.
2
Enter file in which to save the key (/c/Users/you/.ssh/id_rsa):
3
Created directory '/c/Users/you/.ssh'.
4
Enter passphrase (empty for no passphrase):
5
Enter same passphrase again:
6
Your identification has been saved in /c/Users/you/.ssh/id_rsa.
7
Your public key has been saved in /c/Users/you/.ssh/id_rsa.pub.
8
The key fingerprint is:
9
SHA256:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx YOUR_EMAIL@EXAMPLE.COM

Confirm the key landed in your .ssh folder:

1
Get-ChildItem .\.ssh\

A typical .ssh folder looks like this:

Directory.ssh/
- id_ed25519 Ed25519 private key never share this
- id_ed25519.pub Ed25519 public key safe to upload
- id_rsa RSA private key (legacy) never share this
- id_rsa.pub RSA public key (legacy) safe to upload
- known_hosts
- config

Add the public SSH key to your account

Copy your public key to the clipboard with PowerShell pick the tab that matches the key type you created:

Ed25519 (recommended)
RSA (legacy)

1
Get-Content .\.ssh\id_ed25519.pub | Set-Clipboard

1
Get-Content .\.ssh\id_rsa.pub | Set-Clipboard

Warning

Only ever copy and paste the public key (the .pub file). The private key (id_ed25519 or id_rsa, with no extension) must never be uploaded or shared with anyone.

Now add that public key to your account. Pick your service below:

GitHub Settings

Select SSH and GPG keys from the sidebar, then New SSH key. Give it a descriptive title (for example, your computer’s name) and paste your public key into the Key field. Click Add SSH key:

GitHub Settings

The key now appears in the list of SSH keys on your account:

GitHub Settings

Test connecting via SSH

Before you start using SSH with Git, all three services let you check that the connection works.

Once you’ve added your SSH key to your GitHub account, open the terminal and type:

1
ssh -T [email protected]

If you’re connecting to GitHub over SSH for the first time, the SSH client will ask if you trust the GitHub server’s public key:

1
The authenticity of host 'github.com (140.82.113.4)' can't be established.
2
RSA key fingerprint is SHA256:a5d6c20b1790b4c144b9d26c9b201bbee3797aa010f2701c09c1b3a6262d2c02.
3
Are you sure you want to continue connecting (yes/no)?

Type yes and press Enter. GitHub is added to your known hosts and won’t prompt again:

1
Warning: Permanently added 'github.com,140.82.113.4' (RSA) to the list of known hosts.

GitHub only allows this SSH connection for testing, not shell access, so it confirms you’re authenticated and then closes the connection:

1
Hi YOUR_USER_NAME! You've successfully authenticated, but GitHub does not provide shell access.

The whole interaction should look something like this:

1
ssh -T [email protected]
2

3
The authenticity of host 'github.com (140.82.113.4)' can't be established.
4
RSA key fingerprint is SHA256:a5d6c20b1790b4c144b9d26c9b201bbee3797aa010f2701c09c1b3a6262d2c02.
5
Are you sure you want to continue connecting (yes/no)? yes
6
Warning: Permanently added 'github.com,140.82.113.4' (RSA) to the list of known hosts.
7
Hi your_user_name! You've successfully authenticated, but GitHub does not provide shell access.

Test passed you’re ready to use SSH with GitHub.

Once you’ve added your SSH key to your GitLab account, the test is pretty similar:

1
ssh -T [email protected]
2

3
The authenticity of host 'gitlab.com (35.231.145.151)' can't be established.
4
ECDSA key fingerprint is SHA256:4ac7a7fd4296d5e6267c9188346375ff78f6097a802e83c0feaf25277c9e70cc.
5
Are you sure you want to continue connecting (yes/no)? yes
6
Warning: Permanently added 'gitlab.com,35.231.145.151' (ECDSA) to the list of known hosts.
7
Welcome to GitLab, @YOUR_USER_NAME!

Test passed you’re ready to use SSH with GitLab.

Once you’ve added your SSH key to your Bitbucket account, the test is pretty similar:

1
ssh -T [email protected]
2

3
The authenticity of host 'bitbucket.org (104.192.143.1)' can't be established.
4
RSA key fingerprint is SHA256:fb7d37d5497c43f73325e0a98638cac8dda3b01a8c31f4ee11e2e953c19e0252.
5
Are you sure you want to continue connecting (yes/no)? yes
6
Warning: Permanently added 'bitbucket.org,104.192.143.1' (RSA) to the list of known hosts.
7
logged in as YOUR_USER_NAME.
8

9
You can use git or hg to connect to Bitbucket. Shell access is disabled.

Test passed you’re ready to use SSH with Bitbucket.

Frequently Asked Questions

How do I stop Windows asking for my passphrase every time?

Use the built-in OpenSSH Authentication Agent. In an admin PowerShell, enable and start the service, then add your key:

1
Get-Service ssh-agent | Set-Service -StartupType Automatic
2
Start-Service ssh-agent
3
ssh-add $HOME\.ssh\id_ed25519

The agent keeps the decrypted key in memory, so you type the passphrase once per login instead of on every Git command.

RSA or Ed25519 which key type should I use?

Use ed25519. The keys are smaller and faster than RSA with comparable security, and it’s what GitHub, GitLab, and Bitbucket recommend. Generate one with ssh-keygen -t ed25519 -C "[email protected]". Reach for rsa -b 4096 only when you need to connect to an older server that doesn’t speak Ed25519.

Can I use the same key for GitHub, GitLab, and Bitbucket?

Yes. The same public key can be added to as many accounts and services as you like there’s no need for a separate key per provider. Just paste id_ed25519.pub (or id_rsa.pub) into each service’s SSH-keys settings.

I get 'Permission denied (publickey)' what's wrong?

Usually the key isn’t loaded in the agent, the public key wasn’t added to the service, or the wrong key path is being used. Run ssh -vT [email protected] to see which key the client offers, confirm the OpenSSH agent is running, and make sure you uploaded the matching .pub file.

ssh or ssh-keygen isn't recognized in PowerShell. Now what?

The OpenSSH client ships with Windows 10/11 but can be disabled. Install it from an admin PowerShell:

1
Add-WindowsCapability -Online -Name OpenSSH.Client~~~~0.0.1.0

Git for Windows also bundles ssh/ssh-keygen, so running the commands inside Git Bash works too.

Git SSH Keys for GitHub, GitLab, and Bitbucket on Windows

Git SSH Keys for GitHub, GitLab, and Bitbucket on Windows