/commands/ssh/ssh-keygen-public-key-from-private
ssh-keygen -y -f id_ed25519: get the public key from a private key
- tool
- OpenSSH
- versions
- OpenSSH 7.x – 10.x
- os
- linux, macos, windows
ssh-keygen -y -f ~/.ssh/id_ed25519 reads a private key and prints the matching public key, in the one-line format used by ~/.ssh/authorized_keys. Redirect it to recreate a lost .pub file: ssh-keygen -y -f ~/.ssh/id_ed25519 > ~/.ssh/id_ed25519.pub. If the key has a passphrase, ssh-keygen asks for it; with -P you can pass it for scripts. The private key is only read, never changed.
Example
ssh-keygen -q -t ed25519 -N '' -C demo@example -f demo_key
ssh-keygen -y -f demo_key > regenerated.pub
cut -d' ' -f1,2 demo_key.pub > a.txt
cut -d' ' -f1,2 regenerated.pub > b.txt
diff a.txt b.txt && echo "public keys match"
cut -d' ' -f1 regenerated.pub
ssh-keygen -y -f demo_key.pub || echo "exit status $?"Output
public keys match ssh-ed25519 Load key "demo_key.pub": invalid format exit status 255
The regenerated key has the same type and key data as the .pub file written by ssh-keygen when the key was created. The last command fails: -y needs the private key, and a .pub file passed by mistake gives invalid format.
Options
| Command | Does |
|---|---|
| ssh-keygen -y -f KEY | Print the public key for private KEY |
| ssh-keygen -y -f KEY > KEY.pub | Recreate the .pub file |
| ssh-keygen -y -P PASSPHRASE -f KEY | Same, with the passphrase on the command line (visible in ps and shell history) |
| ssh-keygen -lf KEY | Fingerprint of the key, also works on the private key file |
| ssh-keygen -y -f KEY | ssh-keygen -lf - | Fingerprint of the derived public key, read from standard input |
| ssh-add -L | Public keys of all keys loaded in ssh-agent |
Errors you may see
| Message | Meaning |
|---|---|
| Load key "KEY": invalid format | The file is not a private key (often the .pub file), or it was damaged, for example by CRLF line endings |
| Load key "KEY": incorrect passphrase supplied to decrypt private key | Wrong passphrase, or no passphrase given in a non-interactive run |
| WARNING: UNPROTECTED PRIVATE KEY FILE! | The private key is readable by other users; ssh-keygen refuses to load it on Linux and macOS |
| No such file or directory | Wrong path; on Windows check %USERPROFILE%\.ssh |
On Linux and macOS the private key must be readable by you only (chmod 600 ~/.ssh/id_ed25519), otherwise ssh-keygen prints the UNPROTECTED PRIVATE KEY FILE warning and ignores the key. On Windows the same check is done with file ACLs by the Windows OpenSSH client.
Where to use the result
Paste the printed line into ~/.ssh/authorized_keys on a server (one key per line), or into the SSH keys settings of GitHub or GitLab. Then test the login with ssh -v user@host and look for Authenticated using "publickey"; if the server still rejects it, the page on Permission denied (publickey) lists the usual causes.
FAQ
Can I get the private key from the public key?
No. The public key is derived from the private key in one direction only. If the private key is lost, generate a new pair and replace the public key on every server and service that used the old one.
Why is the comment missing from the regenerated public key?
For keys in the OpenSSH format ssh-keygen -y prints the comment stored in the private key, if there is one; keys in the older PEM format carry no comment, so the line ends after the key data. The comment is only a label and does not affect authentication; append one by hand if you want it.
How do I check that a .pub file belongs to a private key?
Derive the public key with ssh-keygen -y -f private_key and compare the first two fields (type and key data) with the .pub file, or compare the fingerprints from ssh-keygen -lf on both.