Set Up SSH Key Login on cPanel Hosting Step by Step

To log in to cPanel hosting with an SSH key, you make a key pair (a public key and a private key), put the public key on your cPanel account, authorize it if your cPanel version asks you to, and then connect with ssh -i pointing at your private key. This avoids typing your account password for key-based sessions. Password login remains possible unless your host disables it.

Picture this: you are at a cafe, typing your cPanel password into a terminal. That one password also opens your files, email and databases. A key changes that deal.

By the end of this guide you will have a working key login, a short config entry so you can connect with one word, and a list of fixes for the problems people hit most often.

What an SSH key actually is

SSH (Secure Shell) is the protocol that gives you a command line on the server over an encrypted connection. A key pair is two linked files: the public key, which you can share freely, and the private key, which never leaves your computer.

Think of it like a padlock and its key. You hand the server an open padlock (the public key) and keep the only key (the private key) in your pocket. When you connect, the server checks that you can open its padlock, and your secret never travels across the network.

On the server, the public keys that are allowed to log in live in a file called ~/.ssh/authorized_keys. The OpenSSH sshd manual describes it as the list of public keys "that can be used for logging in as this user", with one key per line.

The cPanel Meridian documentation says it plainly, "Anyone who obtains your private key and passphrase can access your account." So a key is only as safe as where you keep it. We will cover that too.

Before you start

• A cPanel account where SSH is switched on. The cPanel docs say your host can enable or disable the SSH Access interface in WHM's Feature Manager, and "Not all hosting providers allow shell access."
• Your SSH port number. The cPanel examples use port 22, but some hosts use a different port, so ask your host.
• Your cPanel username and the server hostname or IP address (in this guide: exampleuser, example.com and 192.0.2.10, all made-up examples).
• On macOS or Linux: the built-in Terminal, which already includes ssh and ssh-keygen.
• On Windows: PuTTY and its key generator, PuTTYgen. This guide uses PuTTY on Windows because that is what the cPanel docs describe.
• About 15 minutes, and a password manager to store the key passphrase.
• Risk level: low. Adding a key does not turn off password login, so you can still get in the old way if something goes wrong.

Quick tip: if you are about to start doing real work over SSH, such as moving files or running database commands, take a fresh backup first. Our guide to backing up a cPanel site with an offsite copy and a test restore walks through it.

Which cPanel screen do you have?

cPanel currently documents two interfaces, and they handle keys a little differently. Knowing which one you have saves a lot of confusion.

• Classic cPanel: you will find an SSH Access icon under the Security section. The documented path is Home > Security > SSH Access > Manage SSH Keys. Here, a new key must be authorized before it works.
• Meridian (the newer cPanel interface): you open the Security hub and select the Advanced tab, where a section called Terminal Access (SSH) has Generate Key and Import Key buttons. The Meridian page does not describe a separate authorize step.

If you see neither, the feature is probably turned off for your plan. The Meridian docs say, "If you do not see these features, contact your hosting provider to enable them."

Heads up: whichever screen you use, look for an Authorize button or an authorization status next to your key. If it is there and says the key is not authorized, the key will not work yet.

Option A: Create the key on your own computer (recommended)

I prefer this: the private key is born on your laptop and never travels.

Step 1: Generate the key pair on macOS or Linux

Open Terminal. The following command creates a new Ed25519 key pair, labels it with a comment so you can recognise it later, and saves it under a clear file name.

mkdir -p ~/.ssh
ssh-keygen -t ed25519 -C "you@example.com" -f ~/.ssh/cpanel_example

What each part does, per the OpenSSH ssh-keygen manual:

• -t ed25519 picks the key type. The manual lists Ed25519 as the default type, along with others such as rsa and ecdsa.
• -C "Provides a new comment." Use your email or a note like "laptop 2026".
• -f "Specifies the filename of the key file."

When it asks for a passphrase, type a strong one and save it in your password manager. A strong passphrase encrypts the private key, making a copied file harder to misuse.

You should now have two files: ~/.ssh/cpanel_example (private, keep it secret) and ~/.ssh/cpanel_example.pub (public, safe to share).

Step 2: Copy the public key

This command prints the public key so you can copy it. It is one long line that starts with the key type.

cat ~/.ssh/cpanel_example.pub

Copy the whole line, from ssh-ed25519 to the comment. Never share the file without .pub by email or chat.

Step 3: Import the public key into cPanel

In Meridian: open Security, go to the Advanced tab, and in Terminal Access (SSH) click Import Key. Paste the line into the Public Key box, enter a name, and click Import.

In classic cPanel: go to Home > Security > SSH Access > Manage SSH Keys and click Import Key. Enter a name in the box labelled Choose a name for this key (it defaults to id_dsa), paste your key, and click Import.

Import only the public key for login. Keep the Private Key field empty. If your interface rejects that, ask your host to install the public key; do not upload your laptop private key.

Step 4: Authorize the key (classic cPanel)

This is the step that catches most people. The classic docs say, "You must authorize new keys before you attempt to use them."

Go back to Manage SSH Keys. In the Public Keys table, find your key, click Manage next to it, then click Authorize. The Authorization Status column should now show the key as authorized.

In Meridian, the documentation does not mention an authorize step. Still, glance at the key list: if you see an authorize option, use it.

Step 5: Lock down the key file permissions

OpenSSH is strict about who can read your private key. The ssh manual says it "will simply ignore a private key file if it is accessible by others." These commands make the folder and the private key private to your user.

chmod 700 ~/.ssh
chmod 600 ~/.ssh/cpanel_example

Nothing is printed when this works. That silence is the good news.

Option B: Generate the key inside cPanel

You can also let cPanel make the pair. It works, but the private key starts life on the server, so handle it with extra care.

In classic cPanel

Go to Home > Security > SSH Access > Manage SSH Keys and click Generate a New Key. Then:

1. Leave the Key Name as id_rsa or type your own name. The docs warn that with a custom name "you must manually specify the SSH key when you log in to the server."
2. Enter and confirm a password. cPanel scores it from 0 to 100, and some hosts set a minimum strength. There is a Password Generator button if you need one.
3. Choose the key type. At the time of writing (13 October 2026), the classic page lists DSA and RSA. Choose RSA.
4. Choose the key size. cPanel notes that bigger keys are more secure but give larger files and slower logins.
5. Click Generate Key.
6. Authorize it: Manage next to the public key, then Authorize.

To get the private key onto your computer, use the View/Download action next to the key in the Private Keys table, copy the private key text, and save it as a file, for example ~/.ssh/cpanel_example. The cPanel docs only say to save the contents of the key text box, so if this action does not show a private key, use Option A instead. Then run the chmod commands from Step 5 above.

Why not DSA? The OpenSSH sshd manual lists only ECDSA, Ed25519 and RSA as key types for authorized_keys, so RSA is the safe pick here.

In Meridian

Open Security, then the Advanced tab. In Terminal Access (SSH), click Generate Key, enter a name, enter and confirm a passphrase (optional, but please set one), and click + Generate Key.

The Meridian page warns: "Store your private key and passphrase in a secure location." That page does not spell out how the private key gets to your computer, so if you cannot find a way to view or download it, use Option A instead. If you do get it, save it in ~/.ssh/ and lock its permissions as in Step 5.

Connect with your key on macOS or Linux

This command logs in on the port your host gave you, using your private key. Replace the port, username and host with your own values.

ssh -p 22 -i ~/.ssh/cpanel_example exampleuser@example.com

This matches the cPanel docs' pattern ssh -p port -i ssh-key user@IP. You can use the server IP (like 192.0.2.10) instead of the hostname if your host told you to.

On first connection, compare the displayed host-key fingerprint with one supplied by your host through its trusted support portal. Accept it only when they match; the hostname alone does not verify the server. SSH then records it in ~/.ssh/known_hosts.

Next you will be asked for your key passphrase, not your cPanel password. If you did not set a passphrase, cPanel's docs say to just press Enter.

What you should see: a shell prompt on the server, something like [exampleuser@server ~]$.

Save a shortcut in your SSH config

This entry in ~/.ssh/config lets you connect by typing ssh mysite.

Host mysite
    HostName example.com
    User exampleuser
    Port 22
    IdentityFile ~/.ssh/cpanel_example
    IdentitiesOnly yes

Each keyword is documented in the ssh_config manual. IdentityFile points to your private key, and IdentitiesOnly yes tells ssh to use only that key, which avoids "too many keys" confusion if you have several.

Now the login is just this:

ssh mysite

Connect with your key on Windows (PuTTY)

PuTTY needs the private key in its own .ppk format. The PuTTY manual says the key in the session settings "must be in PuTTY's native format (*.PPK)."

Step 1: Get a .ppk file

If you are starting fresh, open PuTTY Key Generator (PuTTYgen) and click Generate. For an Ed25519 key, choose the EdDSA type; the PuTTY manual says the only valid EdDSA size is 255 bits, also known as Ed25519. Enter a passphrase in Key passphrase and Confirm passphrase, then click Save private key and save it as a .ppk file.

Copy the text from the PuTTYgen box meant for pasting into an OpenSSH authorized_keys file, and import it into cPanel as in Option A, Step 3. Then authorize it if you are on classic cPanel.

If you already have an OpenSSH private key (for example, one cPanel generated), open PuTTYgen and use the Import command in the Conversions menu to load it, then click Save private key to write a .ppk copy.

Step 2: Point PuTTY at the key

1. Open PuTTY. In the Session screen, enter the hostname in Host Name (or IP address) and your port in Port.
2. In the left tree, open Connection > SSH > Auth, as the cPanel docs describe. In PuTTY 0.83 the key box is in the Credentials panel, which the PuTTY manual calls a subpane of the Auth panel. It is labelled Private key file for authentication.
3. Click Browse, select your .ppk file, and click Open.
4. Go back to Session, type a name under Saved Sessions, and click Save so you do not repeat this every time.
5. Click Open, enter your cPanel username, then your key passphrase.

What you should see: a black terminal window with your server's shell prompt and no request for your cPanel password.

An illustrative example

Made-up example: Amira runs a small shop site on cPanel. She generates cpanel_example on her laptop, imports the public key on a classic cPanel account, and tries to log in. The server keeps asking for a password.

She checks Manage SSH Keys and sees the key is listed as not authorized. One click on Authorize, and the next ssh mysite drops her straight into the shell after her passphrase. Ten seconds, once she knew where to look.

How to check it worked

These checks take two minutes and prove the key is really what logs you in.

Check 1: Inspect the login

Run a verbose login. The -v flag prints debugging messages.

ssh -v -p 22 -i ~/.ssh/cpanel_example exampleuser@example.com

Look near the end of the output for lines mentioning your key file (cpanel_example) being offered and accepted. If you only get asked for a password, the key was not accepted.

Check 2: Compare your key fingerprint

Record your public-key fingerprint for comparison with the imported key or your host's records.

ssh-keygen -l -f ~/.ssh/cpanel_example.pub

Keep this fingerprint handy. If you ever need help from your host, it lets them confirm which key you mean without you sending the key itself.

Check 3: Confirm authorization

In cPanel, confirm the key is authorized (classic) or listed (Meridian).

Troubleshooting

The server still asks for a password

Symptom: ssh prompts for exampleuser@example.com's password instead of the key passphrase.

Likely cause: on classic cPanel, the key is imported but not authorized. The docs say new keys must be authorized first.

Fix: go to Manage SSH Keys, click Manage next to the public key, then Authorize. Try again with ssh -v and check that your key is offered.

ssh ignores your private key

Symptom: the verbose output shows a warning about the key file's permissions, and the key is skipped.

Likely cause: the private key file can be read by other users. The ssh manual says it will ignore such a file.

Fix: run chmod 600 ~/.ssh/cpanel_example and chmod 700 ~/.ssh, then reconnect.

Connection times out or is refused

Symptom: the command hangs and then fails, before any password or passphrase prompt.

Likely cause: wrong port, or SSH is not enabled for your account. Ports vary by host, and not every host allows shell access.

Fix: ask your host for the SSH port and whether shell access is enabled on your plan. Then use that port with -p or in the Port line of your config.

The wrong key is being used

Symptom: you have several keys, the login fails, and verbose output shows other keys being tried first.

Likely cause: ssh is offering keys you did not intend, or you used a custom key name and did not point to it.

Fix: use -i with the exact path, or add IdentityFile and IdentitiesOnly yes to the host entry in ~/.ssh/config.

PuTTY refuses the key file

Symptom: PuTTY reports it cannot use the key you selected.

Likely cause: the file is in OpenSSH format, not .ppk. PuTTY requires its native format in the private key box.

Fix: open PuTTYgen, use the Import command in the Conversions menu, load the key, then Save private key as .ppk and select that file.

ssh warns that the host identification changed

Symptom: ssh stops with a warning that the server's identification has changed since your last visit.

Likely cause: the server's host key is different from the one saved in ~/.ssh/known_hosts. This can happen after a server move, but it can also be a sign of interception.

Fix: stop and verify the replacement fingerprint with your host. Only after verification, remove the old entry with ssh-keygen -R example.com, reconnect, and match the new fingerprint. For a custom port, remove [example.com]:PORT instead.

You lost the passphrase

Symptom: you cannot open your private key.

Likely cause: the passphrase was not saved anywhere.

Fix: the ssh-keygen manual is blunt: "There is no way to recover a lost passphrase." Create a new key pair, import and authorize it, then remove or deauthorize the old key in cPanel.

Security habits worth keeping

• Always set a passphrase on the private key and keep it in a password manager.
• Remove keys you no longer use. In classic cPanel, Deauthorize blocks the key; after that, "that key's users cannot log in with the associated private key." Delete Key removes it.
• Remember that deleting is permanent. The Meridian docs say, "You cannot recover a deleted key."
• Keep a second way in. Do not delete your only working key until a new one works.
• Protect the cPanel login itself. Anyone who logs into cPanel can add their own key, so turn on two-factor authentication using our guide to two-factor authentication on cPanel, Plesk and DirectAdmin.

For automation, Meridian API tokens are in Account Preferences > avatar > Profile > Connections > API tokens. They appear once and can expire or be revoked. Treat them like passwords; current docs say feature-level restrictions are unavailable.

When to ask your host

Reach out if you cannot find SSH Access or Terminal Access (SSH) at all, do not know your SSH port, or your key is authorized with correct permissions and is still rejected.

Once SSH works, it makes other jobs faster too, like the moves described in our guide to migrating WordPress without FTP using cPanel and a backup.

The one message worth forwarding

Send this to your host's support team if you get stuck:

"Hi, I am setting up SSH key login for my cPanel account (username: exampleuser). Could you please confirm: 1) is shell access enabled on my plan, 2) which SSH port should I use, 3) does my account use the classic SSH Access screen or the Meridian Security hub, and 4) does my imported public key need to be authorized? My key fingerprint is [paste output of ssh-keygen -l]. Thank you."

Takeaway: generate the key on your own device, import only what you must, click Authorize if your cPanel shows it, and test with ssh -v before you trust it.