Let’s start with a precise, plain-English definition before touching how GitHub actually uses it.

The Simple Definition

An SSH key is a pair of mathematically related digital files used to prove your identity to a remote computer — in this case, GitHub’s servers — without sending a password across the network at all. It always comes in two matching halves: a public key, which you can freely share with anyone, and a private key, which must never leave your own computer.

Why SSH Keys Exist

Passwords have a fundamental weakness: to prove you know one, you typically have to send it, or something derived from it, across the network — and anything sent repeatedly is a bigger target for theft. SSH keys solve this with a clever trick from public-key cryptography: your computer can prove it holds the private key without ever transmitting it anywhere. GitHub only ever needs to store the public half, which is safe to share even if someone else sees it.

Everything about SSH keys makes more sense once you understand exactly what each half is for.

Here’s what actually happens, step by step, the moment your computer connects to GitHub over SSH.

sequenceDiagram
    participant Y as Your Computer
    participant G as GitHub
    Y->>G: Request connection, offer public key identity
    G->>Y: Send a random challenge
    Y->>Y: Sign challenge with private key
    Y->>G: Send back the signed response
    G->>G: Verify response using stored public key
    G-->>Y: Authentication successful
        

Knowing where each half of the pair is stored makes the whole system feel a lot less abstract.

GitHub actually offers a few different ways to authenticate, and it helps to see how they compare.

GitHub actually no longer accepts plain account passwords for Git operations at all — you must use either a personal access token or an SSH key. Compared to typing a token every single time, an SSH key’s biggest everyday advantage is convenience: once it’s set up, you can push and pull repeatedly without ever being prompted to authenticate again.

SSH keys are widely recommended, but they’re not entirely free of trade-offs either.

Because an SSH key effectively acts as your identity, a few basic security habits matter a great deal here.

A short, practical checklist for setting up and maintaining SSH keys responsibly.

SSH keys aren’t unique to GitHub — they’re a foundational piece of how much of the technical world authenticates securely.

No — you can also authenticate using a personal access token over HTTPS. An SSH key is simply a popular, convenient alternative that avoids typing credentials repeatedly.

Yes — the public key is specifically designed to be shared freely. Its security depends entirely on keeping the matching private key secret, not on hiding the public key.

You simply generate a brand-new key pair and register the new public key with GitHub, then remove the old, lost key from your account settings so it can no longer be used.

No — the public key alone cannot be used to authenticate as you. Only someone holding the matching private key can prove your identity to GitHub.

It’s generally better to use separate keys per major context so that access to one service can be revoked without affecting your identity everywhere else.

An SSH key is a matched pair of digital files — a shareable public key and a closely guarded private key — that lets your computer prove its identity to GitHub without ever sending a password or the private key itself across the network. GitHub stores your public key and issues a cryptographic challenge that only your private key can correctly answer, letting you clone, push, and pull without repeated login prompts. Understanding this basic public-private relationship demystifies what can otherwise feel like a mysterious setup step, turning it into a simple, logical piece of everyday developer workflow.