CodeBrowser

We earn commissions when you shop through the links below. Learn more

Ed25519 vs RSA: Which SSH Key Should You Use?

Ed25519 and RSA are the two SSH key types you’ll meet most. Here’s how they compare on security, speed, key size and compatibility, where ECDSA fits in, and exactly which one to pick in 2026.

Ed25519RSA 2048, 3072 & 4096ECDSAPost-quantum SSH

Last updated By the CodeBrowser team

Short answer

Use Ed25519 unless something forces RSA

Ed25519 is the modern choice: strong, fast, short and hard to get wrong. It’s what GitHub recommends and what security-minded admins use for new keys.

Pick RSA only when you have to connect to something that doesn’t support Ed25519, such as a very old server, some network equipment or an older library. If you do, make it at least 3072 bits; 4096 is a safe, common choice.

Create either one

ssh-keygen -t ed25519 -C "work-laptop"

ssh-keygen -t rsa -b 4096 -C "work-laptop"

Or make one in your browser with our SSH Key Generator, which creates Ed25519, RSA 4096 and RSA 2048 keys.

Compare

Ed25519 vs RSA vs ECDSA at a glance

Ed25519RSA 4096ECDSA (nistp256)
Security levelAbout 128-bitAbout 140-bit (2048-bit RSA is about 112)About 128-bit
Public key lengthAbout 80 charactersAbout 720 charactersAbout 160 characters
Signing speedVery fastSlowFast
Needs good randomness to signNo (deterministic)NoYes, a weak random number can leak the key
Supported sinceOpenSSH 6.5 (2014)EverywhereOpenSSH 5.7 (2011)
Best forAlmost everyoneLegacy systems and strict compatibilitySystems that require NIST curves

Ed25519

Why Ed25519 is the better default

Strong with no settings

Every Ed25519 key has the same strength. There’s no key size to choose, so there’s no way to pick a weak one by accident.

Short and fast

The whole public key fits on one line, and signing and verifying are much faster than RSA, which helps on busy servers and slow devices.

Harder to misuse

Ed25519 signatures are deterministic, so a bad random number generator can’t leak your private key, a real risk with ECDSA.

RSA

When RSA still makes sense

  • Old servers. Systems with OpenSSH older than 6.5, such as CentOS 6, can’t use Ed25519 keys.
  • Network gear and appliances. Some routers, switches and storage devices only accept RSA.
  • Older libraries. Some older SSH libraries in Java, PHP or embedded tools lack Ed25519 support.
  • Compliance rules. Some organizations still mandate RSA or ECDSA keys.

RSA 2048 or 4096?

A 2048-bit RSA key is still considered secure today, but it offers less headroom than Ed25519. If you’re creating a new RSA key, use 3072 or 4096 bits. The bigger key costs a little speed and is the safer long-term choice.

Common confusion

“ssh-rsa algorithm is disabled”: is RSA deprecated?

No. Your RSA key is fine. What OpenSSH 8.8 (2021) turned off by default is the old ssh-rsa signature method, which uses the weak SHA-1 hash. Modern clients sign with the same RSA key using rsa-sha2-256 or rsa-sha2-512 instead.

If you see “no matching host key type found” or “ssh-rsa algorithm is disabled”, one side of the connection is too old to use the SHA-2 methods. The real fix is to update it. As a temporary workaround for one legacy host, you can re-enable the old method for that host only:

Host old-router
    HostKeyAlgorithms +ssh-rsa
    PubkeyAcceptedAlgorithms +ssh-rsa

Looking ahead

What about quantum computers?

Neither Ed25519 nor RSA would survive a large quantum computer, but SSH is already preparing. Since OpenSSH 10.0 (2025), connections use the hybrid post-quantum key exchange mlkem768x25519-sha256 by default, which protects the encryption of your session against future quantum attacks.

That covers the session itself. Your login key is only used to prove who you are at connection time, so switching key types for quantum reasons isn’t necessary yet.

Check which key type you have

ssh-keygen -l -f ~/.ssh/id_ed25519.pub

The output shows the key size, fingerprint and type, for example 256 SHA256:… (ED25519) or 4096 SHA256:… (RSA).

Switching

How to switch from RSA to Ed25519

Create the new key

Run ssh-keygen -t ed25519. Your old id_rsa stays where it is.

Add it everywhere

Copy the new public key to your servers and to GitHub or GitLab, next to the old one.

Test it

Connect with ssh -i ~/.ssh/id_ed25519 user@server to make sure the new key works.

Remove the old key

Delete the old RSA public key from each server’s authorized_keys and your accounts.

Need step-by-step instructions for Windows, Mac or Linux? See our guide on how to generate an SSH key.

Need a server?

Put your new key to work

Every host below accepts Ed25519 keys, and most let you add yours when you create the server.

Best overall

DigitalOcean

Simple cloud servers with great docs. Add your SSH key when you create a Droplet.

From about $4/month

View DigitalOcean deals
Most RAM for the money

Hostinger

4 GB of RAM and NVMe storage on the entry VPS plan, with an easy control panel.

About $5.19/month on a 24-month term with our extra 20% off

Get 20% off Hostinger VPS
Best budget

RackNerd

Yearly KVM VPS deals for about the price of one month elsewhere. Great for learning.

From about $11/year on promo

View RackNerd deals

Prices are approximate. Compare all VPS hosts, including Vultr and ShockHosting.

FAQ

Ed25519 and RSA questions, answered

Is Ed25519 more secure than RSA?

Ed25519 offers about 128-bit security, similar to 3072-bit RSA and more than 2048-bit RSA. It is also harder to misuse, because it has no key size to get wrong and does not depend on randomness when signing. In practice, both are secure when used correctly.

Is Ed25519 better than RSA 4096?

For almost everyone, yes. RSA 4096 has a slightly higher theoretical security level, but Ed25519 is far faster, much shorter and just as safe in practice. RSA 4096 mainly makes sense when you need to connect to systems that do not support Ed25519.

Does GitHub support Ed25519 keys?

Yes. GitHub recommends Ed25519 keys and supports RSA and ECDSA as well. GitLab, Bitbucket and all major cloud providers accept Ed25519 keys too.

Should I replace my existing RSA key?

If it is 2048 bits or larger and was created recently, it is still secure, so there is no rush. Switching to Ed25519 the next time you set up a new computer is a sensible upgrade. Replace 1024-bit RSA keys right away.

What about ECDSA keys?

ECDSA is fast and short like Ed25519, but it relies on NIST curves and needs a good random number for every signature. Ed25519 avoids both concerns, so it is usually the better pick unless a policy requires NIST curves.

Can I use both an Ed25519 and an RSA key?

Yes. Keep both in your .ssh folder and tell SSH which one to use for each server with IdentityFile in your SSH config file. SSH will also try both keys automatically if you do not specify one.

Written by the CodeBrowser team

CodeBrowser builds free SSH and server tools and writes plain-English guides for developers and sysadmins. We check every guide against current documentation and update it when commands, apps or prices change.

About CodeBrowserSpotted a mistake? Tell us

Ready to make an Ed25519 key?

Need a .ppk version for PuTTY too? Convert any key between OpenSSH and PuTTY formats in your browser.

Open the SSH Key Converter