How do I generate an SSH key and fix "Permission denied (publickey)" when connecting to my server?

Generate a key (client side)

ssh-keygen -t ed25519 -C "you@laptop"

Ed25519 is short, fast and widely supported. Use a passphrase and an agent (ssh-add).

Install the public key

ssh-copy-id -i ~/.ssh/id_ed25519.pub user@host

Or append the single line of id_ed25519.pub to ~/.ssh/authorized_keys on the server.

Why publickey is denied: permissions and ownership. sshd (with StrictModes yes) ignores keys if the home directory or files are too open:

chmod 755 ~            # not group/world writable
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys
chown -R user:user ~/.ssh

Other causes

• The wrong public key pasted (line breaks inside the key break it; it must be one line).
• Wrong user name, or the client offers another key: force one with ssh -i ~/.ssh/id_ed25519 -o IdentitiesOnly=yes user@host.
• PubkeyAuthentication no in /etc/ssh/sshd_config.
• Cloud images use a default user (ubuntu, ec2-user, root) different from yours.
• Read the server side log: sudo journalctl -u ssh -n 50 or /var/log/auth.log. Client side debugging: ssh -vvv user@host.

Then harden in /etc/ssh/sshd_config (or a file in sshd_config.d/):

PasswordAuthentication no
PermitRootLogin prohibit-password

Validate with sudo sshd -t and reload sudo systemctl reload ssh. Keep your current session open and test a second login before closing it, to avoid locking yourself out.

A browser-side generator is also available: SSH key generator, although generating keys locally with ssh-keygen is preferable for private keys.