--- title: "Git SSH Keys for GitHub, GitLab, and Bitbucket on Windows" description: "Git connects to remotes by default via HTTPS, which requires you to enter your login and password every time you run a command like Git pull or git push, using the SSH protocol. You may connect to servers and authenticate to access their services. The three services listed allow Git to connect through SSH rather than HTTPS. Using public-key encryption eliminates the need to type a login and password for each Git command." author: "Mohammad Abu Mattar" canonical: https://mkabumattar.com/blog/post/git-ssh-keys-for-github-gitlab-and-bitbucket-on-windows --- # Git SSH Keys for GitHub, GitLab, and Bitbucket on Windows ## Introduction By default, Git talks to remotes over HTTPS, so it asks for your username and password on every `git pull` or `git push`. SSH fixes that. GitHub, GitLab, and Bitbucket all let Git authenticate over SSH with public-key encryption instead. Set it up once and you stop typing credentials for every Git command. An SSH key is a pair of files: a **private key** that never leaves your machine, and a **public key** you upload to each service. Authentication works by proving you hold the private key. No password travels over the network. ## Make sure Git is installed Before you start, check whether Git is already on your machine. Run this in Windows Terminal (or PowerShell): ```powershell git --version ``` If you get a version number back, you're set skip to [Generate SSH keys](#generate-ssh-keys). If the command isn't found, install Git using whichever method you prefer. 1. Download the latest **Git for Windows** from the official site. 2. Run the installer. The defaults are sensible clicking **Next** through each screen is fine for most setups, including the editor, line-ending, and terminal choices. 3. Click **Install**, then **Finish**. 4. Open a new terminal and confirm it worked: ```powershell git --version ``` ```powershell choco install git -y ``` Then confirm the install: ```powershell git --version ``` ```powershell winget install --id Git.Git -e ``` Then confirm the install: ```powershell git --version ``` After installing Git, set your global name and email every commit you make is stamped with them: ```powershell git config --global user.name 'USERNAME' git config --global user.email 'YOUR_EMAIL@EXAMPLE.COM' ``` ## Generate SSH keys Open Windows Terminal and generate a new key pair, replacing `YOUR_EMAIL@EXAMPLE.COM` with your email address. **Use Ed25519** it's what GitHub, GitLab, and Bitbucket recommend today. Reach for RSA only on an older system or server that doesn't support Ed25519. ```powershell ssh-keygen -t ed25519 -C "YOUR_EMAIL@EXAMPLE.COM" ``` This creates `.ssh\id_ed25519` (private) and `.ssh\id_ed25519.pub` (public) in your user folder. Ed25519 keys are small and fast, with security on par with a 4096-bit RSA key. ```powershell ssh-keygen -t rsa -b 4096 -C "YOUR_EMAIL@EXAMPLE.COM" ``` This creates `.ssh\id_rsa` (private) and `.ssh\id_rsa.pub` (public). Use the older RSA type only if you need to talk to a legacy system or server that doesn't support Ed25519. After running the command, complete the prompts: 1. Choose where to save the private key. Press Enter to accept the default location (`C:\Users\you\.ssh\id_ed25519`, or `id_rsa` for an RSA key): ```powershell Enter file in which to save the key (/c/Users/you/.ssh/id_ed25519): [Press Enter] ``` 2. If a key already exists, you'll be asked whether to overwrite it. Type `y` and press Enter: ```powershell Overwrite (y/n)? ``` 3. Enter and re-enter a passphrase (think of it as a password for the key): ```powershell Enter passphrase (empty for no passphrase): [Type a passphrase] Enter same passphrase again: [Type passphrase again] ``` A passphrase encrypts your private key on disk, so a stolen key file is useless without it. On Windows you can have the OpenSSH Authentication Agent remember it for you (see the FAQ below) so you only type it once. The whole interaction should look like this: ```powershell Generating public/private ed25519 key pair. Enter file in which to save the key (/c/Users/you/.ssh/id_ed25519): Created directory '/c/Users/you/.ssh'. Enter passphrase (empty for no passphrase): Enter same passphrase again: Your identification has been saved in /c/Users/you/.ssh/id_ed25519. Your public key has been saved in /c/Users/you/.ssh/id_ed25519.pub. The key fingerprint is: SHA256:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx YOUR_EMAIL@EXAMPLE.COM ``` ```powershell Generating public/private rsa key pair. Enter file in which to save the key (/c/Users/you/.ssh/id_rsa): Created directory '/c/Users/you/.ssh'. Enter passphrase (empty for no passphrase): Enter same passphrase again: Your identification has been saved in /c/Users/you/.ssh/id_rsa. Your public key has been saved in /c/Users/you/.ssh/id_rsa.pub. The key fingerprint is: SHA256:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx YOUR_EMAIL@EXAMPLE.COM ``` Confirm the key landed in your `.ssh` folder: ```powershell Get-ChildItem .\.ssh\ ``` A typical `.ssh` folder looks like this: - .ssh/ - **id_ed25519** Ed25519 private key never share this - **id_ed25519.pub** Ed25519 public key safe to upload - **id_rsa** RSA private key (legacy) never share this - **id_rsa.pub** RSA public key (legacy) safe to upload - known_hosts - config ## Add the public SSH key to your account Copy your public key to the clipboard with PowerShell pick the tab that matches the key type you created: ```powershell Get-Content .\.ssh\id_ed25519.pub | Set-Clipboard ``` ```powershell Get-Content .\.ssh\id_rsa.pub | Set-Clipboard ``` Only ever copy and paste the **public** key (the `.pub` file). The private key (`id_ed25519` or `id_rsa`, with no extension) must never be uploaded or shared with anyone. Now add that public key to your account. Pick your service below: Sign in to your GitHub account at github.com. Click your profile photo in the upper-right corner, then **Settings**: ![GitHub Settings](/assets/blog/0010-git-ssh-keys-for-github-gitlab-and-bitbucket-on-windows/github1.png) Select **SSH and GPG keys** from the sidebar, then **New SSH key**. Give it a descriptive title (for example, your computer's name) and paste your public key into the Key field. Click **Add SSH key**: ![GitHub Settings](/assets/blog/0010-git-ssh-keys-for-github-gitlab-and-bitbucket-on-windows/github2.png) The key now appears in the list of SSH keys on your account: ![GitHub Settings](/assets/blog/0010-git-ssh-keys-for-github-gitlab-and-bitbucket-on-windows/github3.png) Sign in to your GitLab account at gitlab.com. Click your profile photo in the upper-right corner, then **Settings**: ![GitLab Settings](/assets/blog/0010-git-ssh-keys-for-github-gitlab-and-bitbucket-on-windows/gitlab1.png) Click **SSH Keys** in the sidebar and paste your public key into the Key field. Add a descriptive title (for example, the name of your computer), then click **Add key**: ![GitLab Settings](/assets/blog/0010-git-ssh-keys-for-github-gitlab-and-bitbucket-on-windows/gitlab2.png) The key now appears in the list of SSH keys on your account: ![GitLab Settings](/assets/blog/0010-git-ssh-keys-for-github-gitlab-and-bitbucket-on-windows/gitlab3.png) Log in to your Bitbucket account at bitbucket.org. Click your profile photo in the lower-left corner, then **Bitbucket settings**: ![Bitbucket Settings](/assets/blog/0010-git-ssh-keys-for-github-gitlab-and-bitbucket-on-windows/bitbucket1.png) Find **SSH keys** under the Security section, then select **Add key**. Add a descriptive label (such as your computer's name) and paste your public key into the Key field. Click **Add key**: ![Bitbucket Settings](/assets/blog/0010-git-ssh-keys-for-github-gitlab-and-bitbucket-on-windows/bitbucket2.png) The key has now been added to your account's list of SSH keys: ![Bitbucket Settings](/assets/blog/0010-git-ssh-keys-for-github-gitlab-and-bitbucket-on-windows/bitbucket3.png) ## Test connecting via SSH Before you start using SSH with Git, all three services let you check that the connection works. Once you've added your SSH key to your GitHub account, open the terminal and type: ```shell ssh -T git@github.com ``` If you're connecting to GitHub over SSH for the first time, the SSH client will ask if you trust the GitHub server's public key: ```shell The authenticity of host 'github.com (140.82.113.4)' can't be established. RSA key fingerprint is SHA256:a5d6c20b1790b4c144b9d26c9b201bbee3797aa010f2701c09c1b3a6262d2c02. Are you sure you want to continue connecting (yes/no)? ``` Type `yes` and press Enter. GitHub is added to your known hosts and won't prompt again: ```shell Warning: Permanently added 'github.com,140.82.113.4' (RSA) to the list of known hosts. ``` GitHub only allows this SSH connection for testing, not shell access, so it confirms you're authenticated and then closes the connection: ```shell Hi YOUR_USER_NAME! You've successfully authenticated, but GitHub does not provide shell access. ``` The whole interaction should look something like this: ```shell ssh -T git@github.com The authenticity of host 'github.com (140.82.113.4)' can't be established. RSA key fingerprint is SHA256:a5d6c20b1790b4c144b9d26c9b201bbee3797aa010f2701c09c1b3a6262d2c02. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added 'github.com,140.82.113.4' (RSA) to the list of known hosts. Hi your_user_name! You've successfully authenticated, but GitHub does not provide shell access. ``` Test passed you're ready to use SSH with GitHub. Once you've added your SSH key to your GitLab account, the test is pretty similar: ```shell ssh -T git@gitlab.com The authenticity of host 'gitlab.com (35.231.145.151)' can't be established. ECDSA key fingerprint is SHA256:4ac7a7fd4296d5e6267c9188346375ff78f6097a802e83c0feaf25277c9e70cc. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added 'gitlab.com,35.231.145.151' (ECDSA) to the list of known hosts. Welcome to GitLab, @YOUR_USER_NAME! ``` Test passed you're ready to use SSH with GitLab. Once you've added your SSH key to your Bitbucket account, the test is pretty similar: ```shell ssh -T git@bitbucket.org The authenticity of host 'bitbucket.org (104.192.143.1)' can't be established. RSA key fingerprint is SHA256:fb7d37d5497c43f73325e0a98638cac8dda3b01a8c31f4ee11e2e953c19e0252. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added 'bitbucket.org,104.192.143.1' (RSA) to the list of known hosts. logged in as YOUR_USER_NAME. You can use git or hg to connect to Bitbucket. Shell access is disabled. ``` Test passed you're ready to use SSH with Bitbucket. ## Frequently Asked Questions > **How do I stop Windows asking for my passphrase every time?** Use the built-in OpenSSH Authentication Agent. In an **admin** PowerShell, enable and start the service, then add your key: ```powershell Get-Service ssh-agent | Set-Service -StartupType Automatic Start-Service ssh-agent ssh-add $HOME\.ssh\id_ed25519 ``` The agent keeps the decrypted key in memory, so you type the passphrase once per login instead of on every Git command. > **RSA or Ed25519 which key type should I use?** Use `ed25519`. The keys are smaller and faster than RSA with comparable security, and it's what GitHub, GitLab, and Bitbucket recommend. Generate one with `ssh-keygen -t ed25519 -C "YOUR_EMAIL@EXAMPLE.COM"`. Reach for `rsa -b 4096` only when you need to connect to an older server that doesn't speak Ed25519. > **Can I use the same key for GitHub, GitLab, and Bitbucket?** Yes. The same **public** key can be added to as many accounts and services as you like there's no need for a separate key per provider. Just paste `id_ed25519.pub` (or `id_rsa.pub`) into each service's SSH-keys settings. > **I get 'Permission denied (publickey)' what's wrong?** Usually the key isn't loaded in the agent, the public key wasn't added to the service, or the wrong key path is being used. Run `ssh -vT git@github.com` to see which key the client offers, confirm the OpenSSH agent is running, and make sure you uploaded the matching `.pub` file. > **ssh or ssh-keygen isn't recognized in PowerShell. Now what?** The OpenSSH client ships with Windows 10/11 but can be disabled. Install it from an **admin** PowerShell: ```powershell Add-WindowsCapability -Online -Name OpenSSH.Client~~~~0.0.1.0 ``` Git for Windows also bundles `ssh`/`ssh-keygen`, so running the commands inside **Git Bash** works too. --- ## References - [Git Official Website - Downloads](https://git-scm.com/downloads) - [Pro Git Book - Generating Your SSH Public Key](https://git-scm.com/book/en/v2/Git-on-the-Server-Generating-Your-SSH-Public-Key) - [GitHub Docs - Generating a new SSH key and adding it to the ssh-agent](https://docs.github.com/en/authentication/connecting-to-github-with-ssh/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent) - [GitHub Docs - Adding a new SSH key to your GitHub account](https://docs.github.com/en/authentication/connecting-to-github-with-ssh/adding-a-new-ssh-key-to-your-github-account) - [GitHub Docs - Working with SSH key passphrases](https://docs.github.com/en/authentication/connecting-to-github-with-ssh/working-with-ssh-key-passphrases) - [GitHub Docs - Testing your SSH connection](https://docs.github.com/en/authentication/connecting-to-github-with-ssh/testing-your-ssh-connection) - [GitLab Docs - Use SSH keys to communicate with GitLab](https://docs.gitlab.com/ee/user/ssh.html) - [Bitbucket Docs - Set up an SSH key](https://support.atlassian.com/bitbucket-cloud/docs/set-up-an-ssh-key/) - [Microsoft Docs - OpenSSH key management for Windows](https://docs.microsoft.com/en-us/windows-server/administration/openssh/openssh_keymanagement) - [Microsoft Docs - Get started with OpenSSH for Windows](https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse) - [Chocolatey - Git Package](https://community.chocolatey.org/packages/git) - [Winget - Git Package](https://github.com/microsoft/winget-pkgs/tree/master/manifests/g/Git/Git) - [PowerShell Set-Clipboard Cmdlet](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/set-clipboard)