ssh-keygen -t ed25519: generate an SSH key

ssh-keygen -t ed25519 -C "you@example.com" creates a new Ed25519 key pair: the private key in ~/.ssh/id_ed25519 and the public key in ~/.ssh/id_ed25519.pub. It asks for a file name and a passphrase. Copy the public key (.pub) to the server's ~/.ssh/authorized_keys, for example with ssh-copy-id. Ed25519 keys are short, fast, and supported by OpenSSH 6.5 and later.

Generate a key

Interactive, with the default path and a passphrase prompt:

ssh-keygen -t ed25519 -C "you@example.com"

Non-interactive, for scripts (-N '' means no passphrase, -f sets the file, -q hides the randomart):

ssh-keygen -q -t ed25519 -N '' -C 'ci@example.org' -f deploy_key
ls deploy_key*
ssh-keygen -l -f deploy_key.pub | awk '{print $1, $3, $4}'
cut -d' ' -f1,3 deploy_key.pub
head -1 deploy_key

deploy_key
deploy_key.pub
256 ci@example.org (ED25519)
ssh-ed25519 ci@example.org
-----BEGIN OPENSSH PRIVATE KEY-----

ssh-keygen -l prints the key size, the SHA256 fingerprint (hidden here, because it is random), the comment and the type.

Install it on a server

ssh-copy-id -i ~/.ssh/id_ed25519.pub user@server.example.com
# without ssh-copy-id (for example on Windows):
cat ~/.ssh/id_ed25519.pub | ssh user@server.example.com 'mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys'

Useful options

For RSA (servers that do not accept Ed25519), use at least 3072 bits: ssh-keygen -t rsa -b 4096.