How to Use SSH Keys Instead of Passwords to Clone Git Repositories

The Problem with Password-Based Authentication in Git

Working with version control daily requires constant interactions with code hosting platforms like GitHub, GitLab, or Bitbucket. Historically, these interactions used traditional usernames and passwords to validate the identity of whoever was sending or receiving modifications. In practice, this means that with every executed command, the system needs to verify that you are truly who you claim to be, demanding credentials over and over again.

With the tightening of security policies in the technology industry, using common passwords for automated operations or command-line tasks has become unviable. Code platforms began blocking direct account passwords due to the high risk of credential leaks and theft. The initial alternative was the adoption of personal access tokens, long strings of characters acting as temporary passwords, yet still requiring periodic renewal and tedious manual management.

This is where asymmetric cryptography via SSH (Secure Shell) keys enters the picture—a network protocol enabling secure data exchange between computers. Instead of memorizing passwords or managing ephemeral tokens, your computer and the remote server converse using advanced mathematics. In practice, the server validates your identity using a cryptographic key pair, completely eliminating the need to type any password during your daily workflow.

How SSH Key Cryptography Works in Practice

To understand SSH without complex jargon, think of an extremely secure physical padlock and key system. You create a pair of mathematical keys on your computer: a public key and a private key. The public key can be openly shared with any server, acting as an open padlock that only your private key can open.

When you attempt to clone a repository or push code, the GitHub server sends an encrypted challenge using your stored public key. Your computer receives this challenge and, utilizing the private key kept secret on your machine, solves the mathematical problem and returns the answer to the server. In practice, if the answer is correct, the server concludes that you hold the corresponding private key and grants instant access without any password traveling across the network.

This mechanism solves two major operational problems in software engineering: convenience and security. The private key never leaves your computer, meaning that even if someone intercepted the network during communication, they could never figure out your credential. Furthermore, you gain agility, as the code push and pull workflow occurs transparently and without annoying interruptions.

Generating and Configuring Your First SSH Key Pair

The first practical step to abandoning passwords is checking if you already have keys configured on your machine. Open your operating system terminal and navigate to the hidden folder responsible for storing these settings, usually located in the user directory under the name '.ssh'. If the folder does not exist or you want to create a modern standard, the currently recommended algorithm is Ed25519.

In your terminal, run the generation command providing your email address as an identification label. In practice, type ssh-keygen -t ed25519 -C '[email protected]' and press enter. The system will prompt you for a location to save the file, and it is highly recommended to accept the default suggestion by simply pressing enter. Next, the terminal will ask for a passphrase, which acts as an extra password to protect your private key usage if someone gains physical access to your computer.

After successful execution, two new files will be generated in the hidden folder: the file without an extension, which is your secret private key and must never be shared with anyone, and the file with the '.pub' extension, which represents your public key. The content of this second file is what you will need to copy and paste into your account settings on the code hosting platform.

Adding the Public Key to GitHub or GitLab

With the public key generated and copied to your computer's clipboard, the next step is registering it with your favorite repository provider. On GitHub, for example, access your account settings in the top right menu, locate the developer settings section, and click on the option dedicated to SSH and GPG keys.

On that screen, click the button to add a new SSH key, assign a descriptive title identifying your current computer — such as 'My Work Laptop' —, and paste the entire content of your public key into the designated text field. It is crucial to ensure that no extra white spaces or accidental line breaks are added during the pasting process, as this would invalidate the server's mathematical reading of the code.

After saving the record, the platform will officially recognize your device. In practice, this means that whenever you interact with a remote repository from that computer, GitHub will use that specific public key to validate your entry, allowing immediate access without password prompts.

Validating the Connection and Troubleshooting Common Issues

Before trying to clone repositories en masse, it is worth running a diagnostic test to ensure everything is configured correctly. The standard command for this check uses the terminal's built-in SSH client pointing to the remote server address. In practice, type ssh -T [email protected] and observe the system's response.

If the configuration is correct, the server will reply with a welcome message informing you that you have successfully authenticated, although GitHub does not provide interactive shell access for security reasons. If any permission error or key refusal occurs, the problem is usually related to the background SSH agent not running or the private key not being registered in the operating system's memory.

To fix registration failures, make sure to start the agent by running eval '$(ssh-agent -s)' and then add your private key to the manager using the command ssh-add ~/.ssh/id_ed25519. This procedure ensures the system knows exactly which key to use when requested by development tools.

Cloning Repositories with SSH URL Instead of HTTPS

A common mistake made by those who have just configured SSH keys is continuing to use traditional HTTPS addresses to clone projects. When you copy a repository URL using HTTPS, the platform assumes you intend to authenticate via password or token, completely ignoring the effort you put into setting up SSH encryption.

To take advantage of the new configuration, make sure to select the SSH tab when copying the repository address from the platform's web interface. In practice, the correct URL will start with [email protected]:user/repository.git instead of https://github.com/.... If you already have a repository previously cloned using HTTPS, there is no need to download it again; simply change the existing remote URL by running the command git remote set-url origin [email protected]:user/repository.git in your terminal.

This small change ensures that all future code push and pull operations occur smoothly, securely, and completely transparently, consolidating a professional development environment free from daily friction.

Final Thoughts on Git Security and Productivity

The transition from passwords to SSH keys represents a major milestone in the technical maturity of any developer or engineering team. Besides eliminating the annoying friction of repeatedly typing credentials, this practice raises the security level of the entire development chain, protecting against interception attacks and weak password leaks.

Adopting modern cryptographic standards like Ed25519 and maintaining the habit of protecting private keys with passphrases ensures an ideal balance between usability and data protection. With the environment properly configured, the Git workflow becomes invisible, allowing absolute focus to remain where it truly matters: creating high-quality code and solving real problems for users.