How to Generate and Use SSH Keys on iPhone
Password auth over SSH works, but key-based auth is faster to connect with and far harder to compromise. GateShell includes an on-device SSH key generator, so you can create a key pair, install the public half on your server, and start connecting with keys — all without the private key ever leaving your iPhone.
Step by step
- 1
Open the SSH key manager in GateShell
In GateShell, go to the SSH key manager from Settings or from a server's Auth Method options. Choose "Generate New Key" to create a fresh key pair directly on your device.
- 2
Pick a key type
GateShell can generate ed25519, P-256 (ECDSA), or RSA key pairs. ed25519 is the modern default — it's fast and has a very small key size — and is a good pick unless a specific server requires RSA or P-256 for compatibility with older SSH implementations.
- 3
Understand where the key lives
The private key is generated on-device and stored in the Apple Keychain, the same hardware-backed, Secure-Enclave-protected storage GateShell uses for passwords. It is never uploaded, synced to a vendor server, or made extractable — GateShell has no backend to send it to even if it wanted to.
- 4
Copy the public key to your server
From the key manager, copy the public key (the .pub value). On your server, append it to "~/.ssh/authorized_keys" for the user you connect as — for example: "echo \"ssh-ed25519 AAAA... \" >> ~/.ssh/authorized_keys". Make sure the file and ".ssh" directory have restrictive permissions (700 for the directory, 600 for the file), which most servers already enforce.
- 5
Connect using key authentication
In GateShell, edit the server and set Auth Method to "SSH Key," then select the key you generated. Connect as usual — GateShell authenticates with the private key from the Keychain instead of a password. You can keep password auth as a fallback on the server until you've confirmed the key connects successfully.
Frequently asked questions
Which SSH key type should I use — ed25519, P-256, or RSA?+
ed25519 is recommended for new keys: it's modern, fast, and uses a small key size. P-256 (ECDSA) is a solid alternative. RSA is mainly there for compatibility with older servers that don't support the newer algorithms.
Does GateShell ever send my private key off my iPhone?+
No. GateShell has zero backend servers. The private key is generated on-device and stored in the Apple Keychain; only the public key is ever copied out, and that's the half that's meant to be shared.
Can I import an existing SSH key instead of generating a new one?+
The key manager is built around on-device generation, which keeps the private key from ever having existed outside the Keychain. If you need to reuse an existing key pair across devices, generating a fresh key per device and authorizing each on the server is the more secure approach.
What permissions does authorized_keys need on the server?+
SSH is strict about this: the ".ssh" directory should be 700 and "authorized_keys" should be 600, both owned by the user you're connecting as. Most distributions set this correctly by default, but misconfigured permissions are a common reason key auth silently falls back to password prompts.
Try it in GateShell
GateShell is a zero-backend SSH client for iPhone, iPad, and Mac — no vendor cloud, no accounts, no telemetry. Everything above works out of the box.
Guide reflects GateShell's shipped features as of July 2026. Steps assume basic familiarity with SSH and the command line; server-side commands may vary by distribution. All product names, logos, and brands are property of their respective owners.